chore(release): bump package version(s) [skip ci]

fix: consume nonce exactly once (#7327 )
* fix: consume nonce exactly once * tweak state handling
2026-05-01 10:55:20 +00:00 · 2023-04-20 09:38:01 +00:00 · 2023-04-20 10:25:41 +01:00 · 2023-04-20 09:53:44 +01:00 · 2023-04-20 08:41:41 +00:00 · 2023-04-20 09:23:30 +01:00
251 changed files with 4870 additions and 3935 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -43,6 +43,7 @@ packages/*/*.d.ts.map
 apps/dev/src/css
 apps/dev/prisma/migrations
 apps/dev/typeorm
+apps/dev/nextjs-2

 # VS
 /.vs/slnx.sqlite-journal
@@ -63,7 +64,6 @@ packages/adapter-prisma/prisma/dev.db
 packages/adapter-prisma/prisma/migrations
 db.sqlite
 packages/adapter-supabase/supabase/.branches
-packages/adapter-drizzle/drizzle

 # Tests
 coverage
--- a/apps/dev/nextjs-v4/.env.local.example
+++ b/apps/dev/nextjs-v4/.env.local.example
@@ -0,0 +1,58 @@
+# Rename file to .env.local (or .env) and populate values
+# to be able to run the dev app
+
+NEXTAUTH_URL=http://localhost:3000
+
+# You can use `openssl rand -hex 32` or 
+# https://generate-secret.vercel.app/32 to generate a secret.
+# Note: Changing a secret may invalidate existing sessions
+# and/or verification tokens.
+NEXTAUTH_SECRET=secret
+
+AUTH0_ID=
+AUTH0_SECRET=
+AUTH0_ISSUER=
+
+KEYCLOAK_ID=
+KEYCLOAK_SECRET=
+KEYCLOAK_ISSUER=
+
+IDS4_ID=
+IDS4_SECRET=
+IDS4_ISSUER=
+
+GITHUB_ID=
+GITHUB_SECRET=
+
+TWITCH_ID=
+TWITCH_SECRET=
+
+TWITTER_ID=
+TWITTER_SECRET=
+
+LINE_ID=
+LINE_SECRET=
+
+TRAKT_ID=
+TRAKT_SECRET=
+
+# Example configuration for a Gmail account (will need SMTP enabled)
+EMAIL_SERVER=smtps://user@gmail.com:password@smtp.gmail.com:465
+EMAIL_FROM=user@gmail.com
+
+# Note: If using with Prisma adapter, you need to use a `.env`
+# file rather than a `.env.local` file to configure env vars.
+# Postgres: DATABASE_URL=postgres://nextauth:password@127.0.0.1:5432/nextauth?synchronize=true
+# MySQL:    DATABASE_URL=mysql://nextauth:password@127.0.0.1:3306/nextauth?synchronize=true
+# MongoDB:  DATABASE_URL=mongodb://nextauth:password@127.0.0.1:27017/nextauth?synchronize=true
+DATABASE_URL=
+
+WIKIMEDIA_ID=
+WIKIMEDIA_SECRET=
+
+# Supabase Example Configuration
+# Supabase Example Configuration
+# NEXT_PUBLIC_SUPABASE_URL=http://localhost:54321
+# SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6InNlcnZpY2Vfcm9sZSJ9.vI9obAHOGyVVKa3pD--kJlyxp-Z2zV9UUMAhKpNLAcU
+# SUPABASE_JWT_SECRET=super-secret-jwt-token-with-at-least-32-characters-long
+# NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6ImFub24ifQ.625_WdcF3KHqz5amU0x2X5WWHP-OEs_4qj0ssLNHzTs
--- a/apps/dev/nextjs-v4/.vscode/settings.json
+++ b/apps/dev/nextjs-v4/.vscode/settings.json
@@ -0,0 +1,4 @@
+{
+  "typescript.tsdk": "../../node_modules/.pnpm/typescript@4.8.4/node_modules/typescript/lib",
+  "typescript.enablePromptUseWorkspaceTsdk": true
+}
--- a/apps/dev/nextjs-v4/README.md
+++ b/apps/dev/nextjs-v4/README.md
@@ -0,0 +1,6 @@
+# NextAuth.js Development App
+
+This folder contains a Next.js app using NextAuth.js for local development. See the following section on how to start:
+
+[Setting up local environment
+](https://github.com/nextauthjs/next-auth/blob/main/CONTRIBUTING.md#setting-up-local-environment)
--- a/apps/dev/nextjs-v4/app/api/auth/[...nextauth]/route.ts
+++ b/apps/dev/nextjs-v4/app/api/auth/[...nextauth]/route.ts
@@ -0,0 +1,14 @@
+import NextAuth, { type NextAuthOptions } from "next-auth"
+import GitHub from "next-auth/providers/github"
+
+export const authOptions: NextAuthOptions = {
+  providers: [
+    GitHub({
+      clientId: process.env.GITHUB_ID,
+      clientSecret: process.env.GITHUB_SECRET,
+    }),
+  ],
+}
+
+const handler = NextAuth(authOptions)
+export { handler as GET, handler as POST }
--- a/apps/dev/nextjs-v4/app/layout.tsx
+++ b/apps/dev/nextjs-v4/app/layout.tsx
@@ -0,0 +1,12 @@
+export default function RootLayout({
+  children,
+}: {
+  children: React.ReactNode
+}) {
+  return (
+    <html>
+      <head></head>
+      <body>{children}</body>
+    </html>
+  )
+}
--- a/apps/dev/nextjs-v4/app/server-component/page.tsx
+++ b/apps/dev/nextjs-v4/app/server-component/page.tsx
@@ -0,0 +1,6 @@
+import { getServerSession } from "next-auth/next"
+
+export default async function Page() {
+  const session = await getServerSession()
+  return <pre>{JSON.stringify(session, null, 2)}</pre>
+}
--- a/apps/dev/nextjs-v4/components/access-denied.js
+++ b/apps/dev/nextjs-v4/components/access-denied.js
@@ -0,0 +1,20 @@
+import { signIn } from "next-auth/react"
+
+export default function AccessDenied() {
+  return (
+    <>
+      <h1>Access Denied</h1>
+      <p>
+        <a
+          href="/api/auth/signin"
+          onClick={(e) => {
+            e.preventDefault()
+            signIn()
+          }}
+        >
+          You must be signed in to view this page
+        </a>
+      </p>
+    </>
+  )
+}
--- a/apps/dev/nextjs-v4/components/footer.js
+++ b/apps/dev/nextjs-v4/components/footer.js
@@ -0,0 +1,28 @@
+import Link from "next/link"
+import styles from "./footer.module.css"
+import packageJSON from "package.json"
+
+export default function Footer() {
+  return (
+    <footer className={styles.footer}>
+      <hr />
+      <ul className={styles.navItems}>
+        <li className={styles.navItem}>
+          <a href="https://next-auth.js.org">Documentation</a>
+        </li>
+        <li className={styles.navItem}>
+          <a href="https://www.npmjs.com/package/next-auth">NPM</a>
+        </li>
+        <li className={styles.navItem}>
+          <a href="https://github.com/nextauthjs/next-auth-example">GitHub</a>
+        </li>
+        <li className={styles.navItem}>
+          <Link href="/policy">Policy</Link>
+        </li>
+        <li className={styles.navItem}>
+          <em>{packageJSON.version}</em>
+        </li>
+      </ul>
+    </footer>
+  )
+}
--- a/apps/dev/nextjs-v4/components/footer.module.css
+++ b/apps/dev/nextjs-v4/components/footer.module.css
@@ -0,0 +1,14 @@
+.footer {
+  margin-top: 2rem;
+}
+
+.navItems {
+  margin-bottom: 1rem;
+  padding: 0;
+  list-style: none;
+}
+
+.navItem {
+  display: inline-block;
+  margin-right: 1rem;
+}
--- a/apps/dev/nextjs-v4/components/header.js
+++ b/apps/dev/nextjs-v4/components/header.js
@@ -0,0 +1,103 @@
+import Link from "next/link"
+import { signIn, signOut, useSession } from "next-auth/react"
+import styles from "./header.module.css"
+
+// The approach used in this component shows how to built a sign in and sign out
+// component that works on pages which support both client and server side
+// rendering, and avoids any flash incorrect content on initial page load.
+export default function Header() {
+  const { data: session, status } = useSession()
+
+  return (
+    <header>
+      <noscript>
+        <style>{".nojs-show { opacity: 1; top: 0; }"}</style>
+      </noscript>
+      <div className={styles.signedInStatus}>
+        <p
+          className={`nojs-show ${
+            !session && status === "loading" ? styles.loading : styles.loaded
+          }`}
+        >
+          {!session && (
+            <>
+              <span className={styles.notSignedInText}>
+                You are not signed in
+              </span>
+              <a
+                href="/api/auth/signin"
+                className={styles.buttonPrimary}
+                onClick={(e) => {
+                  e.preventDefault()
+                  signIn()
+                }}
+              >
+                Sign in
+              </a>
+            </>
+          )}
+          {session && (
+            <>
+              {session.user.image && (
+                <img src={session.user.image} className={styles.avatar} />
+              )}
+              <span className={styles.signedInText}>
+                <small>Signed in as</small>
+                <br />
+                <strong>{session.user.email} </strong>
+                {session.user.name ? `(${session.user.name})` : null}
+              </span>
+              <a
+                href="/api/auth/signout"
+                className={styles.button}
+                onClick={(e) => {
+                  e.preventDefault()
+                  signOut()
+                }}
+              >
+                Sign out
+              </a>
+            </>
+          )}
+        </p>
+      </div>
+      <nav>
+        <ul className={styles.navItems}>
+          <li className={styles.navItem}>
+            <Link href="/">Home</Link>
+          </li>
+          <li className={styles.navItem}>
+            <Link href="/client">Client</Link>
+          </li>
+          <li className={styles.navItem}>
+            <Link href="/server">Server</Link>
+          </li>
+          <li className={styles.navItem}>
+            <Link href="/protected">Protected</Link>
+          </li>
+          <li className={styles.navItem}>
+            <Link href="/protected-ssr">Protected(SSR)</Link>
+          </li>
+          <li className={styles.navItem}>
+            <Link href="/api-example">API</Link>
+          </li>
+          <li className={styles.navItem}>
+            <Link href="/credentials">Credentials</Link>
+          </li>
+          <li className={styles.navItem}>
+            <Link href="/email">Email</Link>
+          </li>
+          <li className={styles.navItem}>
+            <Link href="/middleware-protected">Middleware protected</Link>
+          </li>
+          <li className={styles.navItem}>
+            <Link href="/supabase-client-rls">Supabase RLS</Link>
+          </li>
+          <li className={styles.navItem}>
+            <Link href="/supabase-ssr">Supabase RLS(SSR)</Link>
+          </li>
+        </ul>
+      </nav>
+    </header>
+  )
+}
--- a/apps/dev/nextjs-v4/components/header.module.css
+++ b/apps/dev/nextjs-v4/components/header.module.css
@@ -0,0 +1,92 @@
+/* Set min-height to avoid page reflow while session loading */
+.signedInStatus {
+  display: block;
+  min-height: 4rem;
+  width: 100%;
+}
+
+.loading,
+.loaded {
+  position: relative;
+  top: 0;
+  opacity: 1;
+  overflow: hidden;
+  border-radius: 0 0 .6rem .6rem;
+  padding: .6rem 1rem;
+  margin: 0;
+  background-color: rgba(0,0,0,.05);
+  transition: all 0.2s ease-in;
+}
+
+.loading {
+  top: -2rem;
+  opacity: 0;
+}
+
+.signedInText,
+.notSignedInText {
+  position: absolute;
+  padding-top: .8rem;
+  left: 1rem;
+  right: 6.5rem;
+  white-space: nowrap;
+  text-overflow: ellipsis;
+  overflow: hidden;
+  display: inherit;  
+  z-index: 1;
+  line-height: 1.3rem;
+}
+
+.signedInText {
+  padding-top: 0rem;
+  left: 4.6rem;
+}
+
+.avatar {
+  border-radius: 2rem;
+  float: left;
+  height: 2.8rem;
+  width: 2.8rem;
+  background-color: white;
+  background-size: cover;
+  background-repeat: no-repeat;
+}
+
+.button,
+.buttonPrimary {
+  float: right;
+  margin-right: -.4rem;
+  font-weight: 500;
+  border-radius: .3rem;
+  cursor: pointer;
+  font-size: 1rem;
+  line-height: 1.4rem;
+  padding: .7rem .8rem;
+  position: relative;
+  z-index: 10;
+  background-color: transparent;
+  color: #555;
+}
+
+.buttonPrimary {
+  background-color: #346df1;
+  border-color: #346df1;
+  color: #fff;
+  text-decoration: none;
+  padding: .7rem 1.4rem;
+}
+
+.buttonPrimary:hover {
+  box-shadow: inset 0 0 5rem rgba(0,0,0,0.2)
+}
+
+.navItems {
+  margin-bottom: 2rem;
+  padding: 0;
+  list-style: none;
+}
+
+.navItem {
+  display: inline-block;
+  margin-right: 1rem;
+}
--- a/apps/dev/nextjs-v4/components/layout.js
+++ b/apps/dev/nextjs-v4/components/layout.js
@@ -0,0 +1,14 @@
+import Header from 'components/header'
+import Footer from 'components/footer'
+
+export default function Layout ({ children }) {
+  return (
+    <>
+      <Header />
+      <main>
+        {children}
+      </main>
+      <Footer />
+    </>
+  )
+}
--- a/apps/dev/nextjs-v4/middleware.ts
+++ b/apps/dev/nextjs-v4/middleware.ts
@@ -0,0 +1,45 @@
+export { default } from "next-auth/middleware"
+
+export const config = { matcher: ["/middleware-protected"] }
+
+// Other ways to use this middleware
+
+// import withAuth from "next-auth/middleware"
+// import { withAuth } from "next-auth/middleware"
+
+// export function middleware(req, ev) {
+//   return withAuth(req)
+// }
+
+// export function middleware(req, ev) {
+//   return withAuth(req, ev)
+// }
+
+// export function middleware(req, ev) {
+//   return withAuth(req, {
+//     callbacks: {
+//       authorized: ({ token }) => !!token,
+//     },
+//   })
+// }
+
+// export default withAuth(function middleware(req, ev) {
+//   console.log(req.nextauth.token)
+// })
+
+// export default withAuth(
+//   function middleware(req, ev) {
+//     console.log(req, ev)
+//   },
+//   {
+//     callbacks: {
+//       authorized: ({ token }) => token.name === "Balázs Orbán",
+//     },
+//   }
+// )
+
+// export default withAuth({
+//   callbacks: {
+//     authorized: ({ token }) => !!token,
+//   },
+// })
--- a/apps/dev/nextjs-v4/next-env.d.ts
+++ b/apps/dev/nextjs-v4/next-env.d.ts
@@ -0,0 +1,6 @@
+/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+/// <reference types="next/navigation-types/compat/navigation" />
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/basic-features/typescript for more information.
--- a/apps/dev/nextjs-v4/next.config.js
+++ b/apps/dev/nextjs-v4/next.config.js
@@ -0,0 +1,9 @@
+/** @type {import("next").NextConfig} */
+module.exports = {
+  webpack(config) {
+    config.experiments = { ...config.experiments, topLevelAwait: true }
+    return config
+  },
+  experimental: { appDir: true },
+  typescript: { ignoreBuildErrors: true },
+}
--- a/apps/dev/nextjs-v4/package.json
+++ b/apps/dev/nextjs-v4/package.json
@@ -0,0 +1,40 @@
+{
+  "name": "next-auth-app-v4",
+  "version": "1.0.0",
+  "description": "NextAuth.js Developer app",
+  "private": true,
+  "scripts": {
+    "clean": "rm -rf .next",
+    "dev": "next dev",
+    "lint": "next lint",
+    "build": "next build",
+    "start": "next start",
+    "email": "fake-smtp-server",
+    "start:email": "pnpm email"
+  },
+  "license": "ISC",
+  "dependencies": {
+    "@next-auth/fauna-adapter": "workspace:*",
+    "@next-auth/prisma-adapter": "workspace:*",
+    "@next-auth/supabase-adapter": "workspace:*",
+    "@next-auth/typeorm-legacy-adapter": "workspace:*",
+    "@prisma/client": "^3",
+    "@supabase/supabase-js": "^2.0.5",
+    "faunadb": "^4",
+    "next": "13.3.0",
+    "next-auth": "workspace:*",
+    "nodemailer": "^6",
+    "react": "^18",
+    "react-dom": "^18"
+  },
+  "devDependencies": {
+    "@types/jsonwebtoken": "^8.5.5",
+    "@types/react": "^18.0.15",
+    "@types/react-dom": "^18.0.6",
+    "fake-smtp-server": "^0.8.0",
+    "pg": "^8.7.3",
+    "prisma": "^3",
+    "sqlite3": "^5.0.8",
+    "typeorm": "0.3.7"
+  }
+}
--- a/apps/dev/nextjs-v4/pages/_app.js
+++ b/apps/dev/nextjs-v4/pages/_app.js
@@ -0,0 +1,10 @@
+import { SessionProvider } from "next-auth/react"
+import "./styles.css"
+
+export default function App({ Component, pageProps }) {
+  return (
+    <SessionProvider session={pageProps.session}>
+      <Component {...pageProps} />
+    </SessionProvider>
+  )
+}
--- a/apps/dev/nextjs-v4/pages/api-example.js
+++ b/apps/dev/nextjs-v4/pages/api-example.js
@@ -0,0 +1,17 @@
+import Layout from '../components/layout'
+
+export default function Page () {
+  return (
+    <Layout>
+      <h1>API Example</h1>
+      <p>The examples below show responses from the example API endpoints.</p>
+      <p><em>You must be signed in to see responses.</em></p>
+      <h2>Session</h2>
+      <p>/api/examples/session</p>
+      <iframe src='/api/examples/session' />
+      <h2>JSON Web Token</h2>
+      <p>/api/examples/jwt</p>
+      <iframe src='/api/examples/jwt' />
+    </Layout>
+  )
+}
--- a/apps/dev/nextjs-v4/pages/api/auth-old/[...nextauth].ts
+++ b/apps/dev/nextjs-v4/pages/api/auth-old/[...nextauth].ts
@@ -0,0 +1,132 @@
+import NextAuth, { NextAuthOptions } from "next-auth"
+
+// Providers
+import Apple from "next-auth/providers/apple"
+import Auth0 from "next-auth/providers/auth0"
+import AzureAD from "next-auth/providers/azure-ad"
+import AzureB2C from "next-auth/providers/azure-ad-b2c"
+import BoxyHQSAML from "next-auth/providers/boxyhq-saml"
+// import Cognito from "next-auth/providers/cognito"
+import Credentials from "next-auth/providers/credentials"
+import Discord from "next-auth/providers/discord"
+import DuendeIDS6 from "next-auth/providers/duende-identity-server6"
+// import Email from "next-auth/providers/email"
+import Facebook from "next-auth/providers/facebook"
+import Foursquare from "next-auth/providers/foursquare"
+import Freshbooks from "next-auth/providers/freshbooks"
+import GitHub from "next-auth/providers/github"
+import Gitlab from "next-auth/providers/gitlab"
+import Google from "next-auth/providers/google"
+// import IDS4 from "next-auth/providers/identity-server4"
+import Instagram from "next-auth/providers/instagram"
+// import Keycloak from "next-auth/providers/keycloak"
+import Line from "next-auth/providers/line"
+import LinkedIn from "next-auth/providers/linkedin"
+import Mailchimp from "next-auth/providers/mailchimp"
+// import Okta from "next-auth/providers/okta"
+import Osu from "next-auth/providers/osu"
+import Patreon from "next-auth/providers/patreon"
+import Slack from "next-auth/providers/slack"
+import Spotify from "next-auth/providers/spotify"
+import Trakt from "next-auth/providers/trakt"
+import Twitch from "next-auth/providers/twitch"
+import Twitter from "next-auth/providers/twitter"
+import Vk from "next-auth/providers/vk"
+import Wikimedia from "next-auth/providers/wikimedia"
+import WorkOS from "next-auth/providers/workos"
+
+// // Prisma
+// import { PrismaClient } from "@prisma/client"
+// import { PrismaAdapter } from "@next-auth/prisma-adapter"
+// const client = globalThis.prisma || new PrismaClient()
+// if (process.env.NODE_ENV !== "production") globalThis.prisma = client
+// const adapter = PrismaAdapter(client)
+
+// // Fauna
+// import { Client as FaunaClient } from "faunadb"
+// import { FaunaAdapter } from "@next-auth/fauna-adapter"
+// const opts = { secret: process.env.FAUNA_SECRET, domain: process.env.FAUNA_DOMAIN }
+// const client = globalThis.fauna || new FaunaClient(opts)
+// if (process.env.NODE_ENV !== "production") globalThis.fauna = client
+// const adapter = FaunaAdapter(client)
+
+// // TypeORM
+// import { TypeORMLegacyAdapter } from "@next-auth/typeorm-legacy-adapter"
+// const adapter = TypeORMLegacyAdapter({
+//   type: "sqlite",
+//   name: "next-auth-test-memory",
+//   database: "./typeorm/dev.db",
+//   synchronize: true,
+// })
+
+// // Supabase
+// import { SupabaseAdapter } from "@next-auth/supabase-adapter"
+// const adapter = SupabaseAdapter({
+//   url: process.env.NEXT_PUBLIC_SUPABASE_URL,
+//   secret: process.env.SUPABASE_SERVICE_ROLE_KEY,
+// })
+
+export const authOptions: NextAuthOptions = {
+  // adapter,
+  // debug: process.env.NODE_ENV !== "production",
+  theme: {
+    logo: "https://next-auth.js.org/img/logo/logo-sm.png",
+    brandColor: "#1786fb",
+  },
+  providers: [
+    Credentials({
+      credentials: { password: { label: "Password", type: "password" } },
+      async authorize(credentials) {
+        if (credentials.password !== "pw") return null
+        return { name: "Fill Murray", email: "bill@fillmurray.com", image: "https://www.fillmurray.com/64/64", id: "1", foo: "" }
+      },
+    }),
+    Apple({ clientId: process.env.APPLE_ID, clientSecret: process.env.APPLE_SECRET }),
+    Auth0({ clientId: process.env.AUTH0_ID, clientSecret: process.env.AUTH0_SECRET, issuer: process.env.AUTH0_ISSUER }),
+    AzureAD({
+      clientId: process.env.AZURE_AD_CLIENT_ID,
+      clientSecret: process.env.AZURE_AD_CLIENT_SECRET,
+      tenantId: process.env.AZURE_AD_TENANT_ID,
+    }),
+    AzureB2C({ clientId: process.env.AZURE_B2C_ID, clientSecret: process.env.AZURE_B2C_SECRET, issuer: process.env.AZURE_B2C_ISSUER }),
+    BoxyHQSAML({ issuer: "https://jackson-demo.boxyhq.com", clientId: "tenant=boxyhq.com&product=saml-demo.boxyhq.com", clientSecret: "dummy" }),
+    // Cognito({ clientId: process.env.COGNITO_ID, clientSecret: process.env.COGNITO_SECRET, issuer: process.env.COGNITO_ISSUER }),
+    Discord({ clientId: process.env.DISCORD_ID, clientSecret: process.env.DISCORD_SECRET }),
+    DuendeIDS6({ clientId: "interactive.confidential", clientSecret: "secret", issuer: "https://demo.duendesoftware.com" }),
+    Facebook({ clientId: process.env.FACEBOOK_ID, clientSecret: process.env.FACEBOOK_SECRET }),
+    Foursquare({ clientId: process.env.FOURSQUARE_ID, clientSecret: process.env.FOURSQUARE_SECRET }),
+    Freshbooks({ clientId: process.env.FRESHBOOKS_ID, clientSecret: process.env.FRESHBOOKS_SECRET }),
+    GitHub({ clientId: process.env.GITHUB_ID, clientSecret: process.env.GITHUB_SECRET }),
+    Gitlab({ clientId: process.env.GITLAB_ID, clientSecret: process.env.GITLAB_SECRET }),
+    Google({ clientId: process.env.GOOGLE_ID, clientSecret: process.env.GOOGLE_SECRET }),
+    // IDS4({ clientId: process.env.IDS4_ID, clientSecret: process.env.IDS4_SECRET, issuer: process.env.IDS4_ISSUER }),
+    Instagram({ clientId: process.env.INSTAGRAM_ID, clientSecret: process.env.INSTAGRAM_SECRET }),
+    // Keycloak({ clientId: process.env.KEYCLOAK_ID, clientSecret: process.env.KEYCLOAK_SECRET, issuer: process.env.KEYCLOAK_ISSUER }),
+    Line({ clientId: process.env.LINE_ID, clientSecret: process.env.LINE_SECRET }),
+    LinkedIn({ clientId: process.env.LINKEDIN_ID, clientSecret: process.env.LINKEDIN_SECRET }),
+    Mailchimp({ clientId: process.env.MAILCHIMP_ID, clientSecret: process.env.MAILCHIMP_SECRET }),
+    // Okta({ clientId: process.env.OKTA_ID, clientSecret: process.env.OKTA_SECRET, issuer: process.env.OKTA_ISSUER }),
+    Osu({ clientId: process.env.OSU_CLIENT_ID, clientSecret: process.env.OSU_CLIENT_SECRET }),
+    Patreon({ clientId: process.env.PATREON_ID, clientSecret: process.env.PATREON_SECRET }),
+    Slack({ clientId: process.env.SLACK_ID, clientSecret: process.env.SLACK_SECRET }),
+    Spotify({ clientId: process.env.SPOTIFY_ID, clientSecret: process.env.SPOTIFY_SECRET }),
+    Trakt({ clientId: process.env.TRAKT_ID, clientSecret: process.env.TRAKT_SECRET }),
+    Twitch({ clientId: process.env.TWITCH_ID, clientSecret: process.env.TWITCH_SECRET }),
+    Twitter({ clientId: process.env.TWITTER_ID, clientSecret: process.env.TWITTER_SECRET }),
+    // TwitterLegacy({ clientId: process.env.TWITTER_LEGACY_ID, clientSecret: process.env.TWITTER_LEGACY_SECRET }),
+    Vk({ clientId: process.env.VK_ID, clientSecret: process.env.VK_SECRET }),
+    Wikimedia({ clientId: process.env.WIKIMEDIA_ID, clientSecret: process.env.WIKIMEDIA_SECRET }),
+    WorkOS({ clientId: process.env.WORKOS_ID, clientSecret: process.env.WORKOS_SECRET }),
+  ],
+}
+
+if (authOptions.adapter) {
+  // TODO:
+  // authOptions.providers.unshift(
+  //   // NOTE: You can start a fake e-mail server with `pnpm email`
+  //   // and then go to `http://localhost:1080` in the browser
+  //   Email({ server: "smtp://127.0.0.1:1025?tls.rejectUnauthorized=false" })
+  // )
+}
+
+export default NextAuth(authOptions)
--- a/apps/dev/nextjs-v4/pages/api/examples/jwt.js
+++ b/apps/dev/nextjs-v4/pages/api/examples/jwt.js
@@ -0,0 +1,7 @@
+// This is an example of how to read a JSON Web Token from an API route
+import { getToken } from "next-auth/jwt"
+
+export default async (req, res) => {
+  const token = await getToken({ req })
+  res.send(JSON.stringify(token, null, 2))
+}
--- a/apps/dev/nextjs-v4/pages/api/examples/protected.js
+++ b/apps/dev/nextjs-v4/pages/api/examples/protected.js
@@ -0,0 +1,19 @@
+// This is an example of to protect an API route
+import { getServerSession } from "next-auth/next"
+import { authOptions } from "../auth/[...nextauth]"
+
+export default async (req, res) => {
+  const session = await getServerSession(req, res, authOptions)
+
+  if (session) {
+    res.send({
+      content:
+        "This is protected content. You can access this content because you are signed in.",
+      session,
+    })
+  } else {
+    res.send({
+      error: "You must be sign in to view the protected content on this page.",
+    })
+  }
+}
--- a/apps/dev/nextjs-v4/pages/api/examples/session.js
+++ b/apps/dev/nextjs-v4/pages/api/examples/session.js
@@ -0,0 +1,8 @@
+// This is an example of how to access a session from an API route
+import { getServerSession } from "next-auth/next"
+import { authOptions } from "../auth/[...nextauth]"
+
+export default async (req, res) => {
+  const session = await getServerSession(req, res, authOptions)
+  res.json(session)
+}
--- a/apps/dev/nextjs-v4/pages/api/examples/supabase-rls.js
+++ b/apps/dev/nextjs-v4/pages/api/examples/supabase-rls.js
@@ -0,0 +1,30 @@
+// This is an example of how to query data from Supabase with RLS.
+// Learn more about Row Levele Security (RLS): https://supabase.com/docs/guides/auth/row-level-security
+import { getServerSession } from "next-auth/next"
+import { authOptions } from "../auth/[...nextauth]"
+import { createClient } from "@supabase/supabase-js"
+
+export default async (req, res) => {
+  const session = await getServerSession(req, res, authOptions)
+
+  if (!session)
+    return res.send(JSON.stringify({ error: "No session!" }, null, 2))
+
+  const { supabaseAccessToken } = session
+
+  const supabase = createClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL,
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY,
+    {
+      global: {
+        headers: {
+          Authorization: `Bearer ${supabaseAccessToken}`,
+        },
+      },
+    }
+  )
+  // Now you can query with RLS enabled.
+  const { data, error } = await supabase.from("users").select("*")
+
+  res.send(JSON.stringify({ supabaseAccessToken, data, error }, null, 2))
+}
--- a/apps/dev/nextjs-v4/pages/client.js
+++ b/apps/dev/nextjs-v4/pages/client.js
@@ -0,0 +1,22 @@
+import Layout from '../components/layout'
+
+export default function Page () {
+  return (
+    <Layout>
+      <h1>Client Side Rendering</h1>
+      <p>
+        This page uses the <strong>useSession()</strong> React Hook in the <strong>&lt;/Header&gt;</strong> component.
+      </p>
+      <p>
+        The <strong>useSession()</strong> React Hook easy to use and allows pages to render very quickly.
+      </p>
+      <p>
+        The advantage of this approach is that session state is shared between pages by using the <strong>Provider</strong> in <strong>_app.js</strong> so
+        that navigation between pages using <strong>useSession()</strong> is very fast.
+      </p>
+      <p>
+        The disadvantage of <strong>useSession()</strong> is that it requires client side JavaScript.
+      </p>
+    </Layout>
+  )
+}
--- a/apps/dev/nextjs-v4/pages/credentials.js
+++ b/apps/dev/nextjs-v4/pages/credentials.js
@@ -0,0 +1,67 @@
+// eslint-disable-next-line no-use-before-define
+import * as React from "react"
+import { signIn, signOut, useSession } from "next-auth/react"
+import Layout from "components/layout"
+
+export default function Page() {
+  const [response, setResponse] = React.useState(null)
+  const handleLogin = (options) => async () => {
+    if (options.redirect) {
+      return signIn("credentials", options)
+    }
+    const response = await signIn("credentials", options)
+    setResponse(response)
+  }
+
+  const handleLogout = (options) => async () => {
+    if (options.redirect) {
+      return signOut(options)
+    }
+    const response = await signOut(options)
+    setResponse(response)
+  }
+
+  const { data: session } = useSession()
+
+  if (session) {
+    return (
+      <Layout>
+        <h1>Test different flows for Credentials logout</h1>
+        <span className="spacing">Default:</span>
+        <button onClick={handleLogout({ redirect: true })}>Logout</button>
+        <br />
+        <span className="spacing">No redirect:</span>
+        <button onClick={handleLogout({ redirect: false })}>Logout</button>
+        <br />
+        <p>Response:</p>
+        <pre style={{ background: "#eee", padding: 16 }}>
+          {JSON.stringify(response, null, 2)}
+        </pre>
+      </Layout>
+    )
+  }
+
+  return (
+    <Layout>
+      <h1>Test different flows for Credentials login</h1>
+      <span className="spacing">Default:</span>
+      <button onClick={handleLogin({ redirect: true, password: "password" })}>
+        Login
+      </button>
+      <br />
+      <span className="spacing">No redirect:</span>
+      <button onClick={handleLogin({ redirect: false, password: "password" })}>
+        Login
+      </button>
+      <br />
+      <span className="spacing">No redirect, wrong password:</span>
+      <button onClick={handleLogin({ redirect: false, password: "" })}>
+        Login
+      </button>
+      <p>Response:</p>
+      <pre style={{ background: "#eee", padding: 16 }}>
+        {JSON.stringify(response, null, 2)}
+      </pre>
+    </Layout>
+  )
+}
--- a/apps/dev/nextjs-v4/pages/email.js
+++ b/apps/dev/nextjs-v4/pages/email.js
@@ -0,0 +1,80 @@
+// eslint-disable-next-line no-use-before-define
+import * as React from "react"
+import { signIn, signOut, useSession } from "next-auth/react"
+import Layout from "components/layout"
+
+export default function Page() {
+  const [response, setResponse] = React.useState(null)
+  const [email, setEmail] = React.useState("")
+
+  const handleChange = (event) => {
+    setEmail(event.target.value)
+  }
+
+  const handleLogin = (options) => async (event) => {
+    event.preventDefault()
+
+    if (options.redirect) {
+      return signIn("email", options)
+    }
+    const response = await signIn("email", options)
+    setResponse(response)
+  }
+
+  const handleLogout = (options) => async (event) => {
+    if (options.redirect) {
+      return signOut(options)
+    }
+    const response = await signOut(options)
+    setResponse(response)
+  }
+
+  const { data: session } = useSession()
+
+  if (session) {
+    return (
+      <Layout>
+        <h1>Test different flows for Email logout</h1>
+        <span className="spacing">Default:</span>
+        <button onClick={handleLogout({ redirect: true })}>Logout</button>
+        <br />
+        <span className="spacing">No redirect:</span>
+        <button onClick={handleLogout({ redirect: false })}>Logout</button>
+        <br />
+        <p>Response:</p>
+        <pre style={{ background: "#eee", padding: 16 }}>
+          {JSON.stringify(response, null, 2)}
+        </pre>
+      </Layout>
+    )
+  }
+
+  return (
+    <Layout>
+      <h1>Test different flows for Email login</h1>
+      <label className="spacing">
+        Email address:{" "}
+        <input
+          type="text"
+          id="email"
+          name="email"
+          value={email}
+          onChange={handleChange}
+        />
+      </label>
+      <br />
+      <form onSubmit={handleLogin({ redirect: true, email })}>
+        <span className="spacing">Default:</span>
+        <button type="submit">Sign in with Email</button>
+      </form>
+      <form onSubmit={handleLogin({ redirect: false, email })}>
+        <span className="spacing">No redirect:</span>
+        <button type="submit">Sign in with Email</button>
+      </form>
+      <p>Response:</p>
+      <pre style={{ background: "#eee", padding: 16 }}>
+        {JSON.stringify(response, null, 2)}
+      </pre>
+    </Layout>
+  )
+}
--- a/apps/dev/nextjs-v4/pages/index.js
+++ b/apps/dev/nextjs-v4/pages/index.js
@@ -0,0 +1,12 @@
+import Layout from 'components/layout'
+
+export default function Page () {
+  return (
+    <Layout>
+      <h1>NextAuth.js Example</h1>
+      <p>
+        This is an example site to demonstrate how to use <a href='https://next-auth.js.org'>NextAuth.js</a> for authentication.
+      </p>
+    </Layout>
+  )
+}
--- a/apps/dev/nextjs-v4/pages/middleware-protected/index.js
+++ b/apps/dev/nextjs-v4/pages/middleware-protected/index.js
@@ -0,0 +1,9 @@
+import Layout from "components/layout"
+
+export default function Page() {
+  return (
+    <Layout>
+      <h1>Page protected by Middleware</h1>
+    </Layout>
+  )
+}
--- a/apps/dev/nextjs-v4/pages/policy.js
+++ b/apps/dev/nextjs-v4/pages/policy.js
@@ -0,0 +1,30 @@
+import Layout from '../components/layout'
+
+export default function Page () {
+  return (
+    <Layout>
+      <p>
+        This is an example site to demonstrate how to use <a href='https://next-auth.js.org'>NextAuth.js</a> for authentication.
+      </p>
+      <h2>Terms of Service</h2>
+      <p>
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+      </p>
+      <h2>Privacy Policy</h2>
+      <p>
+        This site uses JSON Web Tokens and an in-memory database which resets every ~2 hours.
+      </p>
+      <p>
+        Data provided to this site is exclusively used to support signing in
+        and is not passed to any third party services, other than via SMTP or OAuth for the
+        purposes of authentication.
+      </p>
+    </Layout>
+  )
+}
--- a/apps/dev/nextjs-v4/pages/protected-ssr.js
+++ b/apps/dev/nextjs-v4/pages/protected-ssr.js
@@ -0,0 +1,48 @@
+// This is an example of how to protect content using server rendering
+import { getServerSession } from "next-auth/next"
+import { authOptions } from "./api/auth/[...nextauth]"
+import Layout from "../components/layout"
+import AccessDenied from "../components/access-denied"
+
+export default function Page({ content, session }) {
+  // If no session exists, display access denied message
+  if (!session) {
+    return (
+      <Layout>
+        <AccessDenied />
+      </Layout>
+    )
+  }
+
+  // If session exists, display content
+  return (
+    <Layout>
+      <h1>Protected Page</h1>
+      <p>
+        <strong>{content}</strong>
+      </p>
+    </Layout>
+  )
+}
+
+export async function getServerSideProps(context) {
+  const session = await getServerSession(context.req, context.res, authOptions)
+  let content = null
+
+  if (session) {
+    const hostname = process.env.NEXTAUTH_URL || "http://localhost:3000"
+    const options = { headers: { cookie: context.req.headers.cookie } }
+    const res = await fetch(`${hostname}/api/examples/protected`, options)
+    const json = await res.json()
+    if (json.content) {
+      content = json.content
+    }
+  }
+
+  return {
+    props: {
+      session,
+      content,
+    },
+  }
+}
--- a/apps/dev/nextjs-v4/pages/protected.js
+++ b/apps/dev/nextjs-v4/pages/protected.js
@@ -0,0 +1,35 @@
+import { useState, useEffect } from "react"
+import { useSession } from "next-auth/react"
+import Layout from "../components/layout"
+
+export default function Page() {
+  const { status } = useSession({
+    required: true,
+  })
+  const [content, setContent] = useState()
+
+  // Fetch content from protected route
+  useEffect(() => {
+    if (status === "loading") return
+    const fetchData = async () => {
+      const res = await fetch("/api/examples/protected")
+      const json = await res.json()
+      if (json.content) {
+        setContent(json.content)
+      }
+    }
+    fetchData()
+  }, [status])
+
+  if (status === "loading") return <Layout>Loading...</Layout>
+
+  // If session exists, display content
+  return (
+    <Layout>
+      <h1>Protected Page</h1>
+      <p>
+        <strong>{content}</strong>
+      </p>
+    </Layout>
+  )
+}
--- a/apps/dev/nextjs-v4/pages/server.js
+++ b/apps/dev/nextjs-v4/pages/server.js
@@ -0,0 +1,46 @@
+import { getServerSession } from "next-auth/next"
+import Layout from "../components/layout"
+import { authOptions } from "./api/auth/[...nextauth]"
+
+export default function Page() {
+  // As this page uses Server Side Rendering, the `session` will be already
+  // populated on render without needing to go through a loading stage.
+  // This is possible because of the shared context configured in `_app.js` that
+  // is used by `useSession()`.
+
+  return (
+    <Layout>
+      <h1>Server Side Rendering</h1>
+      <p>
+        This page uses the <strong>getServerSession()</strong> method in{" "}
+        <strong>getServerSideProps()</strong>.
+      </p>
+      <p>
+        Using <strong>getServerSession()</strong> in{" "}
+        <strong>getServerSideProps()</strong> is currently the recommended
+        approach, although the API may still change, if you need to support
+        Server Side Rendering with authentication.
+      </p>
+      <p>
+        Using <strong>getSession()</strong> is still recommended on the client.
+      </p>
+      <p>
+        The advantage of Server Side Rendering is this page does not require
+        client side JavaScript.
+      </p>
+      <p>
+        The disadvantage of Server Side Rendering is that this page is slower to
+        render.
+      </p>
+    </Layout>
+  )
+}
+
+// Export the `session` prop to use sessions with Server Side Rendering
+export async function getServerSideProps(context) {
+  return {
+    props: {
+      session: await getServerSession(context.req, context.res, authOptions),
+    },
+  }
+}
--- a/apps/dev/nextjs-v4/pages/styles.css
+++ b/apps/dev/nextjs-v4/pages/styles.css
@@ -0,0 +1,32 @@
+body {
+  font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont,
+    "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif,
+    "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
+  padding: 0 1rem 1rem 1rem;
+  max-width: 680px;
+  margin: 0 auto;
+  background: #fff;
+  color: var(--color-text);
+}
+
+li,
+p {
+  line-height: 1.5rem;
+}
+
+a {
+  font-weight: 500;
+}
+
+hr {
+  border: 1px solid #ddd;
+}
+
+iframe {
+  background: #ccc;
+  border: 1px solid #ccc;
+  height: 10rem;
+  width: 100%;
+  border-radius: .5rem;
+  filter: invert(1);
+}
--- a/apps/dev/nextjs-v4/pages/supabase-client-rls.js
+++ b/apps/dev/nextjs-v4/pages/supabase-client-rls.js
@@ -0,0 +1,49 @@
+import Layout from "../components/layout"
+import { useState, useEffect } from "react"
+import { useSession } from "next-auth/react"
+import { createClient } from "@supabase/supabase-js"
+
+export default function Page() {
+  const { data: session } = useSession()
+  const [data, setData] = useState(null)
+
+  useEffect(() => {
+    if (session) {
+      console.log(session)
+      // User is logged in, let's fetch their data.
+      const { supabaseAccessToken } = session
+      const supabase = createClient(
+        process.env.NEXT_PUBLIC_SUPABASE_URL,
+        process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY,
+        {
+          global: {
+            headers: { Authorization: `Bearer ${supabaseAccessToken}` },
+          },
+        }
+      )
+      // Fetch data with RLS enabled.
+      supabase
+        .from("users")
+        .select("*")
+        .then(({ data }) => setData(data))
+    }
+  }, [session])
+
+  return (
+    <Layout>
+      <h1>Fetch Data from Supabase with RLS</h1>
+      <h2>Client-side data fetching with RLS:</h2>
+      <pre>{JSON.stringify(data, null, 2)}</pre>
+      <h2>API Example</h2>
+      <p>
+        You can also use Supabase in API routes. See the code in the
+        `/pages/api/examples/supabase-rls.js` file.
+      </p>
+      <p>
+        <em>You must be signed in to see responses.</em>
+      </p>
+      <p>/api/examples/supabase-rls</p>
+      <iframe src="/api/examples/supabase-rls" />
+    </Layout>
+  )
+}
--- a/apps/dev/nextjs-v4/pages/supabase-ssr.js
+++ b/apps/dev/nextjs-v4/pages/supabase-ssr.js
@@ -0,0 +1,64 @@
+// This is an example of how to protect content using server rendering
+// and fetching data from Supabase with RLS enabled.
+import { getServerSession } from "next-auth/next"
+import { authOptions } from "./api/auth/[...nextauth]"
+import { createClient } from "@supabase/supabase-js"
+import Layout from "../components/layout"
+import AccessDenied from "../components/access-denied"
+
+export default function Page({ data, session }) {
+  // If no session exists, display access denied message
+  if (!session) {
+    return (
+      <Layout>
+        <AccessDenied />
+      </Layout>
+    )
+  }
+
+  // If session exists, display content
+  return (
+    <Layout>
+      <h1>Protected Page</h1>
+      <p>Data fetched during SSR from Supabase with RSL enabled:</p>
+      <pre>{JSON.stringify(data, null, 2)}</pre>
+    </Layout>
+  )
+}
+
+export async function getServerSideProps(context) {
+  const session = await getServerSession(context.req, context.res, authOptions)
+
+  if (!session)
+    return {
+      props: {
+        session,
+        data: null,
+        error: "No session",
+      },
+    }
+
+  const { supabaseAccessToken } = session
+
+  const supabase = createClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL,
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY,
+    {
+      global: {
+        headers: {
+          Authorization: `Bearer ${supabaseAccessToken}`,
+        },
+      },
+    }
+  )
+  // Now you can query with RLS enabled.
+  const { data, error } = await supabase.from("users").select("*")
+
+  return {
+    props: {
+      session,
+      data,
+      error,
+    },
+  }
+}
--- a/apps/dev/nextjs-v4/prisma/migrations/20230325081057_test/migration.sql
+++ b/apps/dev/nextjs-v4/prisma/migrations/20230325081057_test/migration.sql
@@ -0,0 +1,60 @@
+-- CreateTable
+CREATE TABLE "Account" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "userId" TEXT NOT NULL,
+    "type" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "providerAccountId" TEXT NOT NULL,
+    "refresh_token" TEXT,
+    "access_token" TEXT,
+    "expires_at" INTEGER,
+    "token_type" TEXT,
+    "scope" TEXT,
+    "id_token" TEXT,
+    "session_state" TEXT,
+    "oauth_token_secret" TEXT,
+    "oauth_token" TEXT,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL,
+    CONSTRAINT "Account_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+);
+
+-- CreateTable
+CREATE TABLE "Session" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "sessionToken" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "expires" DATETIME NOT NULL,
+    CONSTRAINT "Session_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+);
+
+-- CreateTable
+CREATE TABLE "User" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "name" TEXT,
+    "email" TEXT,
+    "emailVerified" DATETIME,
+    "image" TEXT
+);
+
+-- CreateTable
+CREATE TABLE "VerificationToken" (
+    "identifier" TEXT NOT NULL,
+    "token" TEXT NOT NULL,
+    "expires" DATETIME NOT NULL
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Account_provider_providerAccountId_key" ON "Account"("provider", "providerAccountId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Session_sessionToken_key" ON "Session"("sessionToken");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "User_email_key" ON "User"("email");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "VerificationToken_token_key" ON "VerificationToken"("token");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "VerificationToken_identifier_token_key" ON "VerificationToken"("identifier", "token");
--- a/apps/dev/nextjs-v4/prisma/migrations/migration_lock.toml
+++ b/apps/dev/nextjs-v4/prisma/migrations/migration_lock.toml
@@ -0,0 +1,3 @@
+# Please do not edit this file manually
+# It should be added in your version-control system (i.e. Git)
+provider = "sqlite"
--- a/apps/dev/nextjs-v4/prisma/schema.prisma
+++ b/apps/dev/nextjs-v4/prisma/schema.prisma
@@ -0,0 +1,57 @@
+datasource db {
+  provider = "sqlite"
+  url      = "file:./dev.db"
+}
+
+generator client {
+  provider = "prisma-client-js"
+}
+
+model Account {
+  id                 String  @id @default(cuid())
+  userId             String
+  type               String
+  provider           String
+  providerAccountId  String
+  refresh_token      String?
+  access_token       String?
+  expires_at         Int?
+  token_type         String?
+  scope              String?
+  id_token           String?
+  session_state      String?
+  oauth_token_secret String?
+  oauth_token        String?
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+  user      User     @relation(fields: [userId], references: [id])
+
+  @@unique([provider, providerAccountId])
+}
+
+model Session {
+  id           String   @id @default(cuid())
+  sessionToken String   @unique
+  userId       String
+  expires      DateTime
+  user         User     @relation(fields: [userId], references: [id])
+}
+
+model User {
+  id            String    @id @default(cuid())
+  name          String?
+  email         String?   @unique
+  emailVerified DateTime?
+  image         String?
+  accounts      Account[]
+  sessions      Session[]
+}
+
+model VerificationToken {
+  identifier String
+  token      String   @unique
+  expires    DateTime
+
+  @@unique([identifier, token])
+}
--- a/apps/dev/nextjs-v4/tsconfig.json
+++ b/apps/dev/nextjs-v4/tsconfig.json
@@ -0,0 +1,39 @@
+{
+  "compilerOptions": {
+    "target": "esnext",
+    "lib": [
+      "dom",
+      "dom.iterable",
+      "esnext"
+    ],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": false,
+    "forceConsistentCasingInFileNames": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "node",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "incremental": true,
+    "jsx": "preserve",
+    "baseUrl": ".",
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ],
+    "strictNullChecks": true
+  },
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules",
+    "jest.config.js"
+  ]
+}
--- a/apps/dev/nextjs-v4/types/nextauth.d.ts
+++ b/apps/dev/nextjs-v4/types/nextauth.d.ts
@@ -0,0 +1,20 @@
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+import NextAuth from "next-auth"
+
+declare module "next-auth" {
+  /**
+   * Returned by `useSession`, `getSession` and received as a prop on the `SessionProvider` React Context
+   */
+  interface Session {
+    // A JWT which can be used as Authorization header with supabase-js for RLS.
+    supabaseAccessToken?: string
+    user: {
+      /** The user's postal address. */
+      address: string
+    } & User
+  }
+
+  interface User {
+    foo: string
+  }
+}
--- a/apps/dev/nextjs/next-env.d.ts
+++ b/apps/dev/nextjs/next-env.d.ts
@@ -1,5 +1,6 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
+/// <reference types="next/navigation-types/compat/navigation" />

 // NOTE: This file should not be edited
 // see https://nextjs.org/docs/basic-features/typescript for more information.
--- a/apps/dev/nextjs/package.json
+++ b/apps/dev/nextjs/package.json
@@ -22,7 +22,7 @@
    "@prisma/client": "^3",
    "@supabase/supabase-js": "^2.0.5",
    "faunadb": "^4",
-    "next": "13.1.1",
+    "next": "13.3.0",
    "next-auth": "workspace:*",
    "nodemailer": "^6",
    "react": "^18",
--- a/apps/dev/nextjs/pages/api/auth/[...nextauth].ts
+++ b/apps/dev/nextjs/pages/api/auth/[...nextauth].ts
@@ -102,7 +102,7 @@ export const authConfig: AuthConfig = {
    Facebook({ clientId: process.env.FACEBOOK_ID, clientSecret: process.env.FACEBOOK_SECRET }),
    Foursquare({ clientId: process.env.FOURSQUARE_ID, clientSecret: process.env.FOURSQUARE_SECRET }),
    Freshbooks({ clientId: process.env.FRESHBOOKS_ID, clientSecret: process.env.FRESHBOOKS_SECRET }),
-    GitHub({ clientId: process.env.GITHUB_ID, clientSecret: process.env.GITHUB_SECRET }),
+    GitHub({ clientId: process.env.GITHUB_ID, clientSecret: process.env.GITHUB_SECRET, redirectProxy: process.env.AUTH_REDIRECT_PROXY_URL }),
    Gitlab({ clientId: process.env.GITLAB_ID, clientSecret: process.env.GITLAB_SECRET }),
    Google({ clientId: process.env.GOOGLE_ID, clientSecret: process.env.GOOGLE_SECRET }),
    // IDS4({ clientId: process.env.IDS4_ID, clientSecret: process.env.IDS4_SECRET, issuer: process.env.IDS4_ISSUER }),
--- a/apps/dev/nextjs/tsconfig.json
+++ b/apps/dev/nextjs/tsconfig.json
@@ -1,7 +1,11 @@
 {
  "compilerOptions": {
    "target": "esnext",
-    "lib": ["dom", "dom.iterable", "esnext"],
+    "lib": [
+      "dom",
+      "dom.iterable",
+      "esnext"
+    ],
    "allowJs": true,
    "skipLibCheck": true,
    "strict": false,
@@ -19,8 +23,17 @@
      {
        "name": "next"
      }
-    ]
+    ],
+    "strictNullChecks": true
  },
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
-  "exclude": ["node_modules", "jest.config.js"]
-}
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules",
+    "jest.config.js"
+  ]
+}
--- a/docs/docs/getting-started/databases.md
+++ b/docs/docs/getting-started/databases.md
@@ -4,15 +4,11 @@ title: Databases

 Auth.js offers multiple database adapters. Check our guides on:

- [using a database adapter](/guides/adapters/using-a-database-adapter)
- [creating your own](/guides/adapters/creating-a-database-adapter)
-
-> As of **v4** Auth.js no longer ships with an adapter included by default. If you would like to persist any information, you need to install one of the many available adapters yourself. See the individual adapter documentation pages for more details.
+- [Using a database adapter](/guides/adapters/using-a-database-adapter)
+- [Creating your own](/guides/adapters/creating-a-database-adapter)

 To learn more about databases in Auth.js and how they are used, check out [databases in the FAQ](/concepts/faq#databases).

---
-
 ## How to use a database

-See the [documentation for adapters](/reference/adapters/overview) for more information on advanced configuration, including how to use Auth.js with other databases using a [custom adapter](/guides/adapters/creating-a-database-adapter).
+See the [documentation for adapters](/reference/adapters) for more information on advanced configuration, including how to use Auth.js with other databases using a [custom adapter](/guides/adapters/creating-a-database-adapter).
--- a/docs/docs/guides/basics/deployment.md
+++ b/docs/docs/guides/basics/deployment.md
@@ -18,77 +18,55 @@ See below for more detailed provider settings.

 ## Vercel

-1. Make sure to expose the Vercel [System Environment Variables](https://vercel.com/docs/concepts/projects/environment-variables#system-environment-variables) in your project settings.
-2. Create a `NEXTAUTH_SECRET` environment variable for all environments.
+1. Make sure to expose the Vercel [System Environment Variables](https://vercel.com/docs/concepts/projects/environment-variables#system-environment-variables) in your project settings. This way, we can detect the environment. (Setting `NEXTAUTH_URL` environment variable on Vercel is **unnecessary**).
+2. Create a `NEXTAUTH_SECRET` environment variable for both Production and Preview environments.
   a. You can use `openssl rand -base64 32` or https://generate-secret.vercel.app/32 to generate a random value.
-   b. You **do not** need the `NEXTAUTH_URL` environment variable in Vercel.
 3. Add your provider's client ID and client secret to environment variables. _(Skip this step if not using an [OAuth Provider](/reference/providers/index))_
 4. Deploy!

 Example repository: https://github.com/nextauthjs/next-auth-example

-A few notes about deploying to Vercel. The environment variables are read server-side, so you do not need to prefix them with `NEXT_PUBLIC_`. When deploying here, you do not need to explicitly set the `NEXTAUTH_URL` environment variable. With other providers **you will** need to also set this environment variable.
+A few notes about deploying to Vercel. The environment variables are read server-side, so you **should not** prefix them with `NEXT_PUBLIC_` to avoid accidentally bundling a secret in the client-side JavaScript code.

 ### Securing a preview deployment

-Securing a preview deployment (with an OAuth provider) comes with some critical obstacles. Most OAuth providers only allow a single redirect/callback URL, or at least a set of full static URLs. Meaning you cannot set the value before publishing the site and you cannot use wildcard subdomains in the callback URL settings of your OAuth provider. Here are a few ways you can still use Auth.js to secure your Preview Deployments.
+Most OAuth providers cannot be configured with multiple callback URLs or using a wildcard. 

-#### Using the Credentials Provider
+However, Auth.js **supports Preview deployments**, even **with OAuth providers**:

-You could check in your `/pages/api/auth/[...nextauth].js` API route / configuration file to see if you're currently in a Vercel preview environment, and if so, enable a simple "credential provider", meaning username/password. Vercel offers a few built-in [system environment variables](https://vercel.com/docs/concepts/projects/environment-variables#system-environment-variables) which you could check against, like `VERCEL_ENV`. This would allow you to use this basic, for testing only, authentication strategy in your preview deployments.
+1. Determine a stable deployment URL. Eg.: A deployment whose URL does not change between builds, for example. `auth.yourdomain.com`),
+2. Set `AUTH_REDIRECT_PROXY_URL` to that URL, adding the path up until your `[...nextauth]` route. Eg.: (`https://auth.yourdomain.com/api/auth`)
+3. For your OAuth provider, set the callback URL using the stable deployment URL. Eg.: For GitHub `https://auth.yourdomain.com/api/auth/callback/github`)

-Some things to be aware of here, include:
+:::info
+To support preview deployments, the `AUTH_SECRET` value needs to be the same for the stable deployment and deployments that will need OAuth support.
+:::

- Do not let this potential testing-only user have access to any critical data
- If possible, maybe do not even connect this preview deployment to your production database

-##### Example
+<details>
+<summary>
+<b>How does this work?</b>
+</summary>
+To support preview deployments, Auth.js uses the stable deployment URL as a redirect proxy server.

-```js title="/pages/api/auth/[...nextauth].js"
-import NextAuth from "next-auth"
-import GoogleProvider from "next-auth/providers/google"
-import CredentialsProvider from "next-auth/providers/credentials"
+It will redirect the OAuth callback request to the preview deployment URL, but only when the `AUTH_REDIRECT_PROXY_URL` environment variable is set. The stable deployment can still act as a regular app.

-export default NextAuth({
-  providers: [
-    process.env.VERCEL_ENV === "preview"
-      ? CredentialsProvider({
-          name: "Credentials",
-          credentials: {
-            username: {
-              label: "Username",
-              type: "text",
-              placeholder: "jsmith",
-            },
-            password: { label: "Password", type: "password" },
-          },
-          async authorize() {
-            return {
-              id: 1,
-              name: "J Smith",
-              email: "jsmith@example.com",
-              image: "https://i.pravatar.cc/150?u=jsmith@example.com",
-            }
-          },
-        })
-      : GoogleProvider({
-          clientId: process.env.GOOGLE_ID,
-          clientSecret: process.env.GOOGLE_SECRET,
-        }),
-  ],
-})
-```
+When a user initiates an OAuth sign-in flow on a preview deployment, we save its URL in the `state` query parameter but set the `redirect_uri` to the stable deployment.

-#### Using the branch based preview URL
+Then, the OAuth provider will redirect the user to the stable deployment, which then will verify the `state` parameter and redirect the user to the preview deployment URL if the `state` is valid. This is secured by relying on the same server-side `AUTH_SECRET` for the stable deployment and the preview deployment.

-Preview deployments at Vercel are often available via multiple URLs. For example, PR's merged to `master` or `main`, will be available the commit and PR specific preview URLs, but also the branch specific preview URLs. This branch specific URL will obviously not change as long as you work with that same branch. Therefore, you could add to your OAuth provider your `{project}-git-main-{user}.vercel.app` preview URL. As this will stay constant for that branch, you can reuse that preview deployment / URL for testing any authentication related deployments.
+See also:
+<ul>
+<li><a href="https://www.ietf.org/rfc/rfc6749.html#section-4.1.1">OAuth 2.0 specification: `state` query parameter</a></li>
+</ul>
+</details>

 ## Netlify

 Netlify is very similar to Vercel in that you can deploy a Next.js project without almost any extra work.

-In order to setup Auth.js correctly here, you will want to make sure you add your `NEXTAUTH_SECRET` environment variable in the project settings. If you are using the [Essential Next.js Build Plugin](https://github.com/netlify/netlify-plugin-nextjs) within your project, you **do not** need to set the `NEXTAUTH_URL` environment variable as it is set automatically as part of the build process.
+To set up Auth.js correctly here, you will want to make sure you add your `NEXTAUTH_SECRET` environment variable in the project settings. If you are using the [Essential Next.js Build Plugin](https://github.com/netlify/netlify-plugin-nextjs) within your project, you **do not** need to set the `NEXTAUTH_URL` environment variable as it is set automatically as part of the build process.

 Netlify also exposes some [system environment variables](https://docs.netlify.com/configure-builds/environment-variables/) from which you can check which `NODE_ENV` you are currently in and much more.

-After this, just make sure you either have your OAuth provider setup correctly with `clientId` / `clientSecret`'s and callback URLs.
+After this, make sure you either have your OAuth provider set up correctly with `clientId` / `clientSecret`'s and callback URLs.
--- a/docs/docs/reference/adapters/index.md
+++ b/docs/docs/reference/adapters/index.md
@@ -9,10 +9,6 @@ Using a Auth.js / NextAuth.js adapter you can connect to any database service or
    <img src="/img/adapters/dgraph.png" width="30" />
    <h4 class="adapter-card__title">Dgraph Adapter</h4>
  </a>
-  <a href="/reference/adapter/drizzle" class="adapter-card">
-    <img src="/img/adapters/drizzle-orm.png" width="30" />
-    <h4 class="adapter-card__title">Drizzle ORM Adapter</h4>
-  </a>
  <a href="/reference/adapter/dynamodb" class="adapter-card">
    <img src="/img/adapters/dynamodb.png" width="30" />
    <h4 class="adapter-card__title">DynamoDB Adapter</h4>
--- a/docs/docusaurus.config.js
+++ b/docs/docusaurus.config.js
@@ -261,33 +261,36 @@ const docusaurusConfig = {
        },
      },
    ],
-    typedocAdapter("Dgraph"),
-    typedocAdapter("Drizzle ORM"),
-    typedocAdapter("DynamoDB"),
-    typedocAdapter("Fauna"),
-    typedocAdapter("Firebase"),
-    typedocAdapter("Mikro ORM"),
-    typedocAdapter("MongoDB"),
-    typedocAdapter("Neo4j"),
-    typedocAdapter("PouchDB"),
-    typedocAdapter("Prisma"),
-    [
-      "docusaurus-plugin-typedoc",
-      {
-        ...typedocConfig,
-        id: "typeorm",
-        plugin: [require.resolve("./typedoc-mdn-links")],
-        watch: process.env.TYPEDOC_WATCH,
-        entryPoints: [`../packages/adapter-typeorm-legacy/src/index.ts`],
-        tsconfig: `../packages/adapter-typeorm-legacy/tsconfig.json`,
-        out: `reference/adapter/typeorm`,
-        sidebar: { indexLabel: "TypeORM" },
-      },
-    ],
-    typedocAdapter("Sequelize"),
-    typedocAdapter("Supabase"),
-    typedocAdapter("Upstash Redis"),
-    typedocAdapter("Xata"),
+    ...(process.env.TYPEDOC_SKIP_ADAPTERS
+      ? []
+      : [
+          typedocAdapter("Dgraph"),
+          typedocAdapter("DynamoDB"),
+          typedocAdapter("Fauna"),
+          typedocAdapter("Firebase"),
+          typedocAdapter("Mikro ORM"),
+          typedocAdapter("MongoDB"),
+          typedocAdapter("Neo4j"),
+          typedocAdapter("PouchDB"),
+          typedocAdapter("Prisma"),
+          [
+            "docusaurus-plugin-typedoc",
+            {
+              ...typedocConfig,
+              id: "typeorm",
+              plugin: [require.resolve("./typedoc-mdn-links")],
+              watch: process.env.TYPEDOC_WATCH,
+              entryPoints: [`../packages/adapter-typeorm-legacy/src/index.ts`],
+              tsconfig: `../packages/adapter-typeorm-legacy/tsconfig.json`,
+              out: `reference/adapter/typeorm`,
+              sidebar: { indexLabel: "TypeORM" },
+            },
+          ],
+          typedocAdapter("Sequelize"),
+          typedocAdapter("Supabase"),
+          typedocAdapter("Upstash Redis"),
+          typedocAdapter("Xata"),
+        ]),
  ],
 }

--- a/docs/package.json
+++ b/docs/package.json
@@ -34,9 +34,9 @@
    "@docusaurus/theme-common": "2.3.1",
    "@docusaurus/theme-mermaid": "2.3.1",
    "@docusaurus/types": "2.3.1",
-    "docusaurus-plugin-typedoc": "1.0.0-next.2",
-    "typedoc": "^0.23.28",
-    "typedoc-plugin-markdown": "4.0.0-next.3"
+    "docusaurus-plugin-typedoc": "1.0.0-next.5",
+    "typedoc": "^0.24.4",
+    "typedoc-plugin-markdown": "4.0.0-next.6"
  },
  "browserslist": {
    "production": [
--- a/docs/sidebars.js
+++ b/docs/sidebars.js
@@ -46,28 +46,31 @@ module.exports = {
        },
      ],
    },
-    {
-      type: "category",
-      label: "Database Adapters",
-      link: { type: "doc", id: "reference/adapters/index" },
-      items: [
-        { type: "doc", id: "reference/adapter/dgraph/index" },
-        { type: "doc", id: "reference/adapter/dynamodb/index" },
-        { type: "doc", id: "reference/adapter/drizzle/index" },
-        { type: "doc", id: "reference/adapter/fauna/index" },
-        { type: "doc", id: "reference/adapter/firebase/index" },
-        { type: "doc", id: "reference/adapter/mikro-orm/index" },
-        { type: "doc", id: "reference/adapter/mongodb/index" },
-        { type: "doc", id: "reference/adapter/neo4j/index" },
-        { type: "doc", id: "reference/adapter/pouchdb/index" },
-        { type: "doc", id: "reference/adapter/prisma/index" },
-        { type: "doc", id: "reference/adapter/sequelize/index" },
-        { type: "doc", id: "reference/adapter/supabase/index" },
-        { type: "doc", id: "reference/adapter/typeorm/index" },
-        { type: "doc", id: "reference/adapter/upstash-redis/index" },
-        { type: "doc", id: "reference/adapter/xata/index" },
-      ],
-    },
+    ...(process.env.TYPEDOC_SKIP_ADAPTERS
+      ? []
+      : [
+          {
+            type: "category",
+            label: "Database Adapters",
+            link: { type: "doc", id: "reference/adapters/index" },
+            items: [
+              { type: "doc", id: "reference/adapter/dgraph/index" },
+              { type: "doc", id: "reference/adapter/dynamodb/index" },
+              { type: "doc", id: "reference/adapter/fauna/index" },
+              { type: "doc", id: "reference/adapter/firebase/index" },
+              { type: "doc", id: "reference/adapter/mikro-orm/index" },
+              { type: "doc", id: "reference/adapter/mongodb/index" },
+              { type: "doc", id: "reference/adapter/neo4j/index" },
+              { type: "doc", id: "reference/adapter/pouchdb/index" },
+              { type: "doc", id: "reference/adapter/prisma/index" },
+              { type: "doc", id: "reference/adapter/sequelize/index" },
+              { type: "doc", id: "reference/adapter/supabase/index" },
+              { type: "doc", id: "reference/adapter/typeorm/index" },
+              { type: "doc", id: "reference/adapter/upstash-redis/index" },
+              { type: "doc", id: "reference/adapter/xata/index" },
+            ],
+          },
+        ]),
    "reference/warnings",
  ],
  conceptsSidebar: [
--- a/docs/static/img/adapters/drizzle-orm.png
+++ b/docs/static/img/adapters/drizzle-orm.png
--- a/docs/typedoc.json
+++ b/docs/typedoc.json
@@ -9,6 +9,7 @@
  "excludeProtected": true,
  "hideHierarchy": true,
  "gitRevision": "main",
+  "groupByReflections": false,
  "hideBreadcrumbs": true,
  "hideGenerator": true,
  "kindSortOrder": [
@@ -36,11 +37,11 @@
    "SetSignature"
  ],
  "readme": "none",
+  "reflectionsWithOwnFile": "none",
  "sort": [
    "kind",
    "static-first",
    "required-first",
    "alphabetical"
-  ],
-  "symbolsWithOwnFile": "none"
+  ]
 }
--- a/package.json
+++ b/package.json
@@ -11,8 +11,11 @@
    "clean": "turbo run clean --no-cache",
    "dev:db": "turbo run dev --parallel --continue --filter=next-auth-app...",
    "dev": "turbo run dev --parallel --continue --filter=next-auth-app... --filter=!./packages/adapter-*",
+    "dev-v4:db": "turbo run dev --parallel --continue --filter=next-auth-app-v4...",
+    "dev-v4": "turbo run dev --parallel --continue --filter=next-auth-app-v4... --filter=!./packages/adapter-*",
    "dev:kit": "turbo run dev --parallel --continue --filter=sveltekit-auth-app...",
-    "dev:docs": "turbo run dev --filter=docs",
+    "dev:docs": "TYPEDOC_SKIP_ADAPTERS=1 turbo run dev --filter=docs",
+    "dev:docs:adapters": "turbo run dev --filter=docs",
    "email": "cd apps/dev/nextjs && pnpm email",
    "eslint": "eslint --cache .",
    "lint": "prettier --check .",
--- a/packages/adapter-dgraph/.npmrc
+++ b/packages/adapter-dgraph/.npmrc
@@ -0,0 +1 @@
+//registry.npmjs.org/:_authToken=${NPM_TOKEN}
--- a/packages/adapter-dgraph/package.json
+++ b/packages/adapter-dgraph/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@next-auth/dgraph-adapter",
-  "version": "1.0.5",
+  "version": "1.0.6",
  "description": "Dgraph adapter for next-auth.",
  "homepage": "https://authjs.dev",
  "repository": "https://github.com/nextauthjs/next-auth",
--- a/packages/adapter-drizzle/README.md
+++ b/packages/adapter-drizzle/README.md
@@ -1,28 +0,0 @@
-<p align="center">
-  <br/>
-  <a href="https://authjs.dev" target="_blank">
-    <img height="64px" src="https://authjs.dev/img/logo/logo-sm.png" />
-  </a>
-  <a href="https://github.com/drizzle-team/drizzle-orm" target="_blank">
-    <img height="64px" src="https://authjs.dev/img/adapters/drizzle-orm.png"/>
-  </a>
-  <h3 align="center"><b>Drizzle ORM Adapter</b> - NextAuth.js / Auth.js</a></h3>
-  <p align="center" style="align: center;">
-    <a href="https://npm.im/@auth/drizzle-adapter">
-      <img src="https://img.shields.io/badge/TypeScript-blue?style=flat-square" alt="TypeScript" />
-    </a>
-    <a href="https://npm.im/@auth/drizzle-adapter">
-      <img alt="npm" src="https://img.shields.io/npm/v/@auth/drizzle-adapter?color=green&label=@auth/drizzle-adapter&style=flat-square">
-    </a>
-    <a href="https://www.npmtrends.com/@auth/drizzle-adapter">
-      <img src="https://img.shields.io/npm/dm/@auth/drizzle-adapter?label=%20downloads&style=flat-square" alt="Downloads" />
-    </a>
-    <a href="https://github.com/nextauthjs/next-auth/stargazers">
-      <img src="https://img.shields.io/github/stars/nextauthjs/next-auth?style=flat-square" alt="Github Stars" />
-    </a>
-  </p>
-</p>
-
---
-
-Check out the documentation at [authjs.dev](https://authjs.dev/reference/adapter/drizzle).
--- a/packages/adapter-drizzle/package.json
+++ b/packages/adapter-drizzle/package.json
@@ -1,57 +0,0 @@
-{
-  "name": "@auth/drizzle-adapter",
-  "version": "0.0.1",
-  "description": "Drizzle ORM adapter for Auth.js",
-  "homepage": "https://authjs.dev/reference/adapter/drizzle",
-  "repository": "https://github.com/nextauthjs/next-auth",
-  "bugs": {
-    "url": "https://github.com/nextauthjs/next-auth/issues"
-  },
-  "author": "Anthony Shew",
-  "license": "ISC",
-  "type": "module",
-  "exports": {
-    ".": {
-      "types": "./index.d.ts",
-      "import": "./index.js"
-    }
-  },
-  "keywords": [
-    "auth.js",
-    "next-auth",
-    "next.js",
-    "oauth",
-    "drizzle"
-  ],
-  "private": false,
-  "publishConfig": {
-    "access": "public"
-  },
-  "scripts": {
-    "clean": "rm -rf *.js *.d.ts* ./drizzle db.sqlite",
-    "test:init": "pnpm clean && drizzle-kit generate:sqlite --schema=src/schema.ts --breakpoints",
-    "test": "pnpm test:init && jest",
-    "build": "pnpm clean && drizzle-kit generate:sqlite --schema=src/schema.ts && tsc",
-    "dev": "drizzle-kit generate:sqlite --schema=src/schema.ts && tsc -w"
-  },
-  "files": [
-    "src",
-    "*.js",
-    "*.d.ts*"
-  ],
-  "peerDependencies": {
-    "drizzle-orm": "^0.23.5"
-  },
-  "devDependencies": {
-    "@next-auth/adapter-test": "workspace:*",
-    "@types/better-sqlite3": "^7.6.3",
-    "better-sqlite3": "^8.2.0",
-    "drizzle-kit": "^0.17.3",
-    "drizzle-orm": "^0.23.5",
-    "jest": "^27.4.3",
-    "next-auth": "workspace:*"
-  },
-  "jest": {
-    "preset": "@next-auth/adapter-test/jest"
-  }
-}
--- a/packages/adapter-drizzle/src/index.ts
+++ b/packages/adapter-drizzle/src/index.ts
@@ -1,248 +0,0 @@
-/**
- * <div style={{display: "flex", justifyContent: "space-between", alignItems: "center", padding: 16}}>
- *  <p style={{fontWeight: "normal"}}>Official <a href="https://github.com/drizzle-team/drizzle-orm">Drizzle ORM</a> adapter for Auth.js / NextAuth.js.</p>
- *  <a href="https://github.com/drizzle-team/drizzle-orm">
- *   <img style={{display: "block"}} src="https://authjs.dev/img/adapters/drizzle-orm.png" width="38" />
- *  </a>
- * </div>
- *
- * ## Installation
- *
- * ```bash npm2yarn2pnpm
- * npm install next-auth drizzle-orm @auth/drizzle-adapter
- * npm install drizzle-kit --save-dev
- * ```
- *
- * @module @auth/drizzle-adapter
- */
-import {
-  accounts,
-  users,
-  sessions,
-  verificationTokens,
-  type DrizzleClient,
-} from "./schema"
-import { and, eq } from "drizzle-orm/expressions"
-import type { Adapter } from "next-auth/adapters"
-
-/**
- * ## Setup
- *
- * Add this adapter to your `pages/api/[...nextauth].js` next-auth configuration object:
- *
- * ```js title="pages/api/auth/[...nextauth].js"
- * import NextAuth from "next-auth"
- * import GoogleProvider from "next-auth/providers/google"
- * import { DrizzleAdapter } from "@auth/drizzle-adapter"
- * import { db } from "./db-schema"
- *
- * export default NextAuth({
- *   adapter: DrizzleAdapter(db),
- *   providers: [
- *     GoogleProvider({
- *       clientId: process.env.GOOGLE_CLIENT_ID,
- *       clientSecret: process.env.GOOGLE_CLIENT_SECRET,
- *     }),
- *   ],
- * })
- * ```
- *
- * ## Advanced usage
- *
- * ### Create the Drizzle schema from scratch
- *
- * You'll need to create a database schema that includes the minimal schema for a `next-auth` adapter.
- * Be sure to use the Drizzle driver version that you're using for your project.
- *
- * > This schema is adapted for use in Drizzle and based upon our main [schema](https://authjs.dev/reference/adapters#models)
- *
- *
- * ```json title="db-schema.ts"
- *
- * import { integer, pgTable, text, primaryKey } from 'drizzle-orm/pg-core';
- * import { drizzle } from 'drizzle-orm/node-postgres';
- * import { migrate } from 'drizzle-orm/node-postgres/migrator';
- * import { Pool } from 'pg'
- * import { ProviderType } from 'next-auth/providers';
- *
- * export const users = pgTable('users', {
- * id: text('id').notNull().primaryKey(),
- * name: text('name'),
- * email: text("email").notNull(),
- * emailVerified: integer("emailVerified"),
- * image: text("image"),
- * });
- *
- * export const accounts = pgTable("accounts", {
- *  userId: text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
- *  type: text("type").$type<ProviderType>().notNull(),
- *  provider: text("provider").notNull(),
- *  providerAccountId: text("providerAccountId").notNull(),
- *  refresh_token: text("refresh_token"),
- *  access_token: text("access_token"),
- *  expires_at: integer("expires_at"),
- *  token_type: text("token_type"),
- *  scope: text("scope"),
- *  id_token: text("id_token"),
- *  session_state: text("session_state"),
- * }, (account) => ({
- *   _: primaryKey(account.provider, account.providerAccountId)
- * }))
- *
- * export const sessions = pgTable("sessions", {
- *  userId: text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
- *  sessionToken: text("sessionToken").notNull().primaryKey(),
- *  expires: integer("expires").notNull(),
- * })
- *
- * export const verificationTokens = pgTable("verificationToken", {
- *  identifier: text("identifier").notNull(),
- *  token: text("token").notNull(),
- *  expires: integer("expires").notNull()
- * }, (vt) => ({
- *   _: primaryKey(vt.identifier, vt.token)
- * }))
- *
- * const pool = new Pool({
- *   connectionString: "YOUR_CONNECTION_STRING"
- * });
- *
- * export const db = drizzle(pool);
- *
- * migrate(db, { migrationsFolder: "./drizzle" })
- *
- * ```
- *
- **/
-export function DrizzleAdapter(client: DrizzleClient): Adapter {
-  return {
-    createUser(data) {
-      return client
-        .insert(users)
-        .values({ ...data, id: "123" })
-        .returning()
-        .get()
-    },
-    getUser(data) {
-      return client.select().from(users).where(eq(users.id, data)).get() ?? null
-    },
-    getUserByEmail(data) {
-      return (
-        client.select().from(users).where(eq(users.email, data)).get() ?? null
-      )
-    },
-    createSession(data) {
-      return client.insert(sessions).values(data).returning().get()
-    },
-    getSessionAndUser(data) {
-      return (
-        client
-          .select({
-            session: sessions,
-            user: users,
-          })
-          .from(sessions)
-          .where(eq(sessions.sessionToken, data))
-          .innerJoin(users, eq(users.id, sessions.userId))
-          .get() ?? null
-      )
-    },
-    updateUser(data) {
-      if (!data.id) throw new Error("No user id.")
-
-      return client
-        .update(users)
-        .set(data)
-        .where(eq(users.id, data.id))
-        .returning()
-        .get()
-    },
-    updateSession(data) {
-      return client
-        .update(sessions)
-        .set(data)
-        .where(eq(sessions.sessionToken, data.sessionToken))
-        .returning()
-        .get()
-    },
-    linkAccount(rawAccount) {
-      const updatedAccount = client
-        .insert(accounts)
-        .values(rawAccount)
-        .returning()
-        .get()
-
-      // HACK: Should not need to set `undefined` values here
-      return {
-        ...updatedAccount,
-        access_token: updatedAccount.access_token ?? undefined,
-        token_type: updatedAccount.token_type ?? undefined,
-        id_token: updatedAccount.id_token ?? undefined,
-        refresh_token: updatedAccount.refresh_token ?? undefined,
-        scope: updatedAccount.scope ?? undefined,
-        expires_at: updatedAccount.expires_at ?? undefined,
-        session_state: updatedAccount.session_state ?? undefined,
-      }
-    },
-    getUserByAccount(account) {
-      return (
-        client
-          .select()
-          .from(users)
-          .innerJoin(
-            accounts,
-            and(
-              eq(accounts.providerAccountId, account.providerAccountId),
-              eq(accounts.provider, account.provider)
-            )
-          )
-          .get()?.users ?? null
-      )
-    },
-    deleteSession(sessionToken) {
-      return client
-        .delete(sessions)
-        .where(eq(sessions.sessionToken, sessionToken))
-        .returning()
-        .get()
-    },
-    createVerificationToken(token) {
-      return client.insert(verificationTokens).values(token).returning().get()
-    },
-    useVerificationToken(token) {
-      try {
-        return (
-          client
-            .delete(verificationTokens)
-            .where(
-              and(
-                eq(verificationTokens.identifier, token.identifier),
-                eq(verificationTokens.token, token.token)
-              )
-            )
-            .returning()
-            .get() ?? null
-        )
-      } catch (err) {
-        throw new Error("No verification token found.")
-      }
-    },
-    deleteUser(id) {
-      return client.delete(users).where(eq(users.id, id)).returning().get()
-    },
-    unlinkAccount(account) {
-      client
-        .delete(accounts)
-        .where(
-          and(
-            eq(accounts.providerAccountId, account.providerAccountId),
-            eq(accounts.provider, account.provider)
-          )
-        )
-        .run()
-
-      // HACK: void should be fine
-      return undefined
-    },
-  }
-}
--- a/packages/adapter-drizzle/src/schema.ts
+++ b/packages/adapter-drizzle/src/schema.ts
@@ -1,63 +0,0 @@
-import { integer, sqliteTable, text, primaryKey } from "drizzle-orm/sqlite-core"
-import { drizzle } from "drizzle-orm/better-sqlite3"
-import { migrate } from "drizzle-orm/better-sqlite3/migrator"
-import Database from "better-sqlite3"
-import { ProviderType } from "next-auth/providers"
-
-const sqlite = new Database("db.sqlite")
-
-export const users = sqliteTable("users", {
-  id: text("id").notNull().primaryKey(),
-  name: text("name"),
-  email: text("email").notNull(),
-  emailVerified: integer("emailVerified", { mode: "timestamp_ms" }),
-  image: text("image"),
-})
-
-export const accounts = sqliteTable(
-  "accounts",
-  {
-    userId: text("userId")
-      .notNull()
-      .references(() => users.id, { onDelete: "cascade" }),
-    type: text("type").$type<ProviderType>().notNull(),
-    provider: text("provider").notNull(),
-    providerAccountId: text("providerAccountId").notNull(),
-    refresh_token: text("refresh_token"),
-    access_token: text("access_token"),
-    expires_at: integer("expires_at"),
-    token_type: text("token_type"),
-    scope: text("scope"),
-    id_token: text("id_token"),
-    session_state: text("session_state"),
-  },
-  (account) => ({
-    nameDoesntMatter: primaryKey(account.provider, account.providerAccountId),
-  })
-)
-
-export const sessions = sqliteTable("sessions", {
-  sessionToken: text("sessionToken").notNull().primaryKey(),
-  userId: text("userId")
-    .notNull()
-    .references(() => users.id, { onDelete: "cascade" }),
-  expires: integer("expires", { mode: "timestamp_ms" }).notNull(),
-})
-
-export const verificationTokens = sqliteTable(
-  "verificationToken",
-  {
-    identifier: text("identifier").notNull(),
-    token: text("token").notNull(),
-    expires: integer("expires", { mode: "timestamp_ms" }).notNull(),
-  },
-  (vt) => ({
-    nameDoesntMatter: primaryKey(vt.identifier, vt.token),
-  })
-)
-
-export const db = drizzle(sqlite)
-
-export type DrizzleClient = typeof db
-
-migrate(db, { migrationsFolder: "./drizzle" })
--- a/packages/adapter-drizzle/tests/index.test.ts
+++ b/packages/adapter-drizzle/tests/index.test.ts
@@ -1,68 +0,0 @@
-import { randomUUID, runBasicTests } from "@next-auth/adapter-test"
-import { DrizzleAdapter } from "../src"
-import { db, users, accounts, sessions, verificationTokens } from '../src/schema'
-import { eq, and } from 'drizzle-orm/expressions';
-
-
-runBasicTests({
-  adapter: DrizzleAdapter(db),
-  db: {
-    id() {
-      return randomUUID()
-    },
-    connect: async () => {
-      await Promise.all([
-        db.delete(sessions).run(),
-        db.delete(accounts).run(),
-        db.delete(verificationTokens).run(),
-        db.delete(users).run(),
-      ])
-    },
-    disconnect: async () => {
-      await Promise.all([
-        db.delete(sessions).run(),
-        db.delete(accounts).run(),
-        db.delete(verificationTokens).run(),
-        db.delete(users).run(),
-      ])
-    },
-    user: (id) => db
-      .select()
-      .from(users)
-      .where(eq(users.id, id))
-      .get() ?? null,
-    session: (sessionToken) => db
-      .select()
-      .from(sessions)
-      .where(eq(sessions.sessionToken, sessionToken))
-      .get() ?? null,
-    account: (provider_providerAccountId) => {
-      return db
-        .select()
-        .from(accounts)
-        .where(
-          eq(
-            accounts.providerAccountId,
-            provider_providerAccountId.providerAccountId
-          )
-        )
-        .get()
-        ?? null
-    },
-    verificationToken: (identifier_token) => db
-      .select()
-      .from(verificationTokens)
-      .where(
-        and(
-          eq(
-            verificationTokens.token,
-            identifier_token.token
-          ),
-          eq(
-            verificationTokens.identifier,
-            identifier_token.identifier
-          )
-        )
-      ).get() ?? null,
-  },
-})
--- a/packages/adapter-drizzle/tsconfig.json
+++ b/packages/adapter-drizzle/tsconfig.json
@@ -1,21 +0,0 @@
-{
-  "compilerOptions": {
-    "allowSyntheticDefaultImports": true,
-    "declaration": true,
-    "declarationMap": true,
-    "module": "ESNext",
-    "moduleResolution": "node",
-    "outDir": ".",
-    "rootDir": "src",
-    "skipDefaultLibCheck": true,
-    "skipLibCheck": true,
-    "strictNullChecks": true,
-    "stripInternal": true,
-    "target": "ES2020",
-  },
-  "exclude": [
-    "tests",
-    "*.js",
-    "*.d.ts*",
-  ]
-}
--- a/packages/adapter-dynamodb/.npmrc
+++ b/packages/adapter-dynamodb/.npmrc
@@ -0,0 +1 @@
+//registry.npmjs.org/:_authToken=${NPM_TOKEN}
--- a/packages/adapter-dynamodb/package.json
+++ b/packages/adapter-dynamodb/package.json
@@ -1,7 +1,7 @@
 {
  "name": "@next-auth/dynamodb-adapter",
  "repository": "https://github.com/nextauthjs/next-auth",
-  "version": "3.0.1",
+  "version": "3.0.2",
  "description": "AWS DynamoDB adapter for next-auth.",
  "keywords": [
    "next-auth",
@@ -59,4 +59,4 @@
  "dependencies": {
    "uuid": "^9.0.0"
  }
-}
+}
--- a/packages/adapter-mongodb/.npmrc
+++ b/packages/adapter-mongodb/.npmrc
@@ -0,0 +1 @@
+//registry.npmjs.org/:_authToken=${NPM_TOKEN}
--- a/packages/adapter-mongodb/package.json
+++ b/packages/adapter-mongodb/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@next-auth/mongodb-adapter",
-  "version": "1.1.1",
+  "version": "1.1.3",
  "description": "mongoDB adapter for next-auth.",
  "homepage": "https://authjs.dev",
  "repository": "https://github.com/nextauthjs/next-auth",
@@ -31,7 +31,7 @@
    "dist"
  ],
  "peerDependencies": {
-    "mongodb": "^5 | ^4",
+    "mongodb": "^5 || ^4",
    "next-auth": "^4"
  },
  "devDependencies": {
@@ -44,4 +44,4 @@
  "jest": {
    "preset": "@next-auth/adapter-test/jest"
  }
-}
+}
--- a/packages/adapter-pouchdb/.npmrc
+++ b/packages/adapter-pouchdb/.npmrc
@@ -0,0 +1 @@
+//registry.npmjs.org/:_authToken=${NPM_TOKEN}
--- a/packages/adapter-pouchdb/package.json
+++ b/packages/adapter-pouchdb/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@next-auth/pouchdb-adapter",
-  "version": "0.1.6",
+  "version": "1.0.0",
  "description": "PouchDB adapter for next-auth.",
  "homepage": "https://authjs.dev",
  "repository": "https://github.com/nextauthjs/next-auth",
@@ -58,4 +58,4 @@
  "jest": {
    "preset": "@next-auth/adapter-test/jest"
  }
-}
+}
--- a/packages/adapter-prisma/.npmrc
+++ b/packages/adapter-prisma/.npmrc
@@ -0,0 +1 @@
+//registry.npmjs.org/:_authToken=${NPM_TOKEN}
--- a/packages/adapter-prisma/package.json
+++ b/packages/adapter-prisma/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@next-auth/prisma-adapter",
-  "version": "1.0.5",
+  "version": "1.0.6",
  "description": "Prisma adapter for next-auth.",
  "homepage": "https://authjs.dev",
  "repository": "https://github.com/nextauthjs/next-auth",
@@ -52,4 +52,4 @@
  "jest": {
    "preset": "@next-auth/adapter-test/jest"
  }
-}
+}
--- a/packages/adapter-sequelize/.npmrc
+++ b/packages/adapter-sequelize/.npmrc
@@ -0,0 +1 @@
+//registry.npmjs.org/:_authToken=${NPM_TOKEN}
--- a/packages/adapter-sequelize/package.json
+++ b/packages/adapter-sequelize/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@next-auth/sequelize-adapter",
-  "version": "1.0.7",
+  "version": "1.0.8",
  "description": "Sequelize adapter for next-auth.",
  "homepage": "https://authjs.dev",
  "repository": "https://github.com/nextauthjs/next-auth",
@@ -42,4 +42,4 @@
  "jest": {
    "preset": "@next-auth/adapter-test/jest"
  }
-}
+}
--- a/packages/adapter-typeorm-legacy/.npmrc
+++ b/packages/adapter-typeorm-legacy/.npmrc
@@ -0,0 +1 @@
+//registry.npmjs.org/:_authToken=${NPM_TOKEN}
--- a/packages/adapter-typeorm-legacy/package.json
+++ b/packages/adapter-typeorm-legacy/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@next-auth/typeorm-legacy-adapter",
-  "version": "2.0.1",
+  "version": "2.0.2",
  "description": "TypeORM (legacy) adapter for next-auth.",
  "homepage": "https://authjs.dev",
  "repository": "https://github.com/nextauthjs/next-auth",
@@ -76,4 +76,4 @@
  "jest": {
    "preset": "@next-auth/adapter-test/jest"
  }
-}
+}
--- a/packages/core/.npmrc
+++ b/packages/core/.npmrc
@@ -0,0 +1 @@
+//registry.npmjs.org/:_authToken=${NPM_TOKEN}
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@auth/core",
-  "version": "0.5.1",
+  "version": "0.7.0",
  "description": "Authentication for the Web.",
  "keywords": [
    "authentication",
--- a/packages/core/scripts/generate-providers.js
+++ b/packages/core/scripts/generate-providers.js
@@ -5,10 +5,11 @@ const providersPath = join(process.cwd(), "src/providers")

 const files = readdirSync(providersPath, "utf8")

+const nonOAuthFile = ["oauth-types", "oauth", "index", "email", "credentials"]
 const providers = files.map((file) => {
  const strippedProviderName = file.substring(0, file.indexOf("."))
  return `"${strippedProviderName}"`
-}).filter((provider) => provider !== '"oauth-types"' && provider !== '"index"')
+}).filter((provider) => !nonOAuthFile.includes(provider.replace(/"/g, '')))

 const result = `
 // THIS FILE IS AUTOGENERATED. DO NOT EDIT.
--- a/packages/core/src/errors.ts
+++ b/packages/core/src/errors.ts
@@ -1,6 +1,5 @@
 interface ErrorCause extends Record<string, unknown> {}

-/** @internal */
 export class AuthError extends Error {
  constructor(message: string | Error | ErrorCause, cause?: ErrorCause) {
    if (message instanceof Error) {
@@ -91,7 +90,7 @@ export class InvalidCallbackUrl extends AuthError {}
 export class InvalidEndpoints extends AuthError {}

 /** @todo */
-export class InvalidState extends AuthError {}
+export class InvalidCheck extends AuthError {}

 /** @todo */
 export class JWTSessionError extends AuthError {}
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -337,4 +337,36 @@ export interface AuthConfig {
  /** @todo */
  trustHost?: boolean
  skipCSRFCheck?: typeof skipCSRFCheck
+  /**
+   * When set, during an OAuth sign-in flow,
+   * the `redirect_uri` of the authorization request
+   * will be set based on this value.
+   *
+   * This is useful if your OAuth Provider only supports a single `redirect_uri`
+   * or you want to use OAuth on preview URLs (like Vercel), where you don't know the final deployment URL beforehand.
+   *
+   * The url needs to include the full path up to where Auth.js is initialized.
+   *
+   * @note This will auto-enable the `state` {@link OAuth2Config.checks} on the provider.
+   *
+   * @example
+   * ```
+   * "https://authjs.example.com/api/auth"
+   * ```
+   *
+   * You can also override this individually for each provider.
+   *
+   * @example
+   * ```ts
+   * GitHub({
+   *   ...
+   *   redirectProxyUrl: "https://github.example.com/api/auth"
+   * })
+   * ```
+   *
+   * @default `AUTH_REDIRECT_PROXY_URL` environment variable
+   *
+   * See also: [Guide: Securing a Preview Deployment](https://authjs.dev/guides/basics/deployment#securing-a-preview-deployment)
+   */
+  redirectProxyUrl?: string
 }
--- a/packages/core/src/jwt.ts
+++ b/packages/core/src/jwt.ts
@@ -48,9 +48,10 @@ const DEFAULT_MAX_AGE = 30 * 24 * 60 * 60 // 30 days
 const now = () => (Date.now() / 1000) | 0

 /** Issues a JWT. By default, the JWT is encrypted using "A256GCM". */
-export async function encode(params: JWTEncodeParams) {
+export async function encode<Payload = JWT>(params: JWTEncodeParams<Payload>) {
  const { token = {}, secret, maxAge = DEFAULT_MAX_AGE } = params
  const encryptionSecret = await getDerivedEncryptionKey(secret)
+  // @ts-expect-error `jose` allows any object as payload.
  return await new EncryptJWT(token)
    .setProtectedHeader({ alg: "dir", enc: "A256GCM" })
    .setIssuedAt()
@@ -60,14 +61,16 @@ export async function encode(params: JWTEncodeParams) {
 }

 /** Decodes a Auth.js issued JWT. */
-export async function decode(params: JWTDecodeParams): Promise<JWT | null> {
+export async function decode<Payload = JWT>(
+  params: JWTDecodeParams
+): Promise<Payload | null> {
  const { token, secret } = params
  if (!token) return null
  const encryptionSecret = await getDerivedEncryptionKey(secret)
  const { payload } = await jwtDecrypt(token, encryptionSecret, {
    clockTolerance: 15,
  })
-  return payload
+  return payload as Payload
 }

 export interface GetTokenParams<R extends boolean = false> {
@@ -179,9 +182,9 @@ export interface DefaultJWT extends Record<string, unknown> {
 */
 export interface JWT extends Record<string, unknown>, DefaultJWT {}

-export interface JWTEncodeParams {
+export interface JWTEncodeParams<Payload = JWT> {
  /** The JWT payload. */
-  token?: JWT
+  token?: Payload
  /** The secret used to encode the Auth.js issued JWT. */
  secret: string
  /**
--- a/packages/core/src/lib/assert.ts
+++ b/packages/core/src/lib/assert.ts
@@ -101,7 +101,8 @@ export function assertConfig(
    )
  }

-  for (const provider of options.providers) {
+  for (const p of options.providers) {
+    const provider = typeof p === "function" ? p() : p
    if (
      (provider.type === "oauth" || provider.type === "oidc") &&
      !(provider.issuer ?? provider.options?.issuer)
@@ -127,7 +128,7 @@ export function assertConfig(
  if (hasCredentials) {
    const dbStrategy = options.session?.strategy === "database"
    const onlyCredentials = !options.providers.some(
-      (p) => p.type !== "credentials"
+      (p) => (typeof p === "function" ? p() : p).type !== "credentials"
    )
    if (dbStrategy && onlyCredentials) {
      return new UnsupportedStrategy(
@@ -135,9 +136,10 @@ export function assertConfig(
      )
    }

-    const credentialsNoAuthorize = options.providers.some(
-      (p) => p.type === "credentials" && !p.authorize
-    )
+    const credentialsNoAuthorize = options.providers.some((p) => {
+      const provider = typeof p === "function" ? p() : p
+      return provider.type === "credentials" && !provider.authorize
+    })
    if (credentialsNoAuthorize) {
      return new MissingAuthorize(
        "Must define an authorize() handler to use credentials authentication provider"
--- a/packages/core/src/lib/index.ts
+++ b/packages/core/src/lib/index.ts
@@ -11,6 +11,7 @@ import type {
  ResponseInternal,
 } from "../types.js"

+/** @internal */
 export async function AuthInternal<
  Body extends string | Record<string, any> | any[]
 >(
--- a/packages/core/src/lib/init.ts
+++ b/packages/core/src/lib/init.ts
@@ -56,10 +56,26 @@ export async function init({
    providers: authOptions.providers,
    url,
    providerId,
+    options: authOptions,
  })

  const maxAge = 30 * 24 * 60 * 60 // Sessions expire after 30 days of being idle by default

+  let isOnRedirectProxy = false
+  if (
+    (provider?.type === "oauth" || provider?.type === "oidc") &&
+    provider.redirectProxyUrl
+  ) {
+    try {
+      isOnRedirectProxy =
+        new URL(provider.redirectProxyUrl).origin === url.origin
+    } catch {
+      throw new TypeError(
+        `redirectProxyUrl must be a valid URL. Received: ${provider.redirectProxyUrl}`
+      )
+    }
+  }
+
  // User provided options are overridden by other options,
  // except for the options with special handling above
  const options: InternalOptions = {
@@ -113,6 +129,7 @@ export async function init({
    callbacks: { ...defaultCallbacks, ...authOptions.callbacks },
    logger,
    callbackUrl: url.origin,
+    isOnRedirectProxy,
  }

  // Init cookies
--- a/packages/core/src/lib/oauth/authorization-url.ts
+++ b/packages/core/src/lib/oauth/authorization-url.ts
@@ -15,7 +15,7 @@ import type { Cookie } from "../cookie.js"
 */
 export async function getAuthorizationUrl(
  query: RequestInternal["query"],
-  options: InternalOptions<"oauth">
+  options: InternalOptions<"oauth" | "oidc">
 ): Promise<ResponseInternal> {
  const { logger, provider } = options

@@ -41,12 +41,21 @@ export async function getAuthorizationUrl(
  }

  const authParams = url.searchParams
+
+  let redirect_uri: string = provider.callbackUrl
+  let data: object | undefined
+  if (!options.isOnRedirectProxy && provider.redirectProxyUrl) {
+    redirect_uri = provider.redirectProxyUrl
+    data = { origin: provider.callbackUrl }
+    logger.debug("using redirect proxy", { redirect_uri, data })
+  }
+
  const params = Object.assign(
    {
      response_type: "code",
      // clientId can technically be undefined, should we check this in assert.ts or rely on the Authorization Server to do it?
      client_id: provider.clientId,
-      redirect_uri: provider.callbackUrl,
+      redirect_uri,
      // @ts-expect-error TODO:
      ...provider.authorization?.params,
    },
@@ -58,7 +67,7 @@ export async function getAuthorizationUrl(

  const cookies: Cookie[] = []

-  const state = await checks.state.create(options)
+  const state = await checks.state.create(options, data)
  if (state) {
    authParams.set("state", state.value)
    cookies.push(state.cookie)
@@ -68,7 +77,7 @@ export async function getAuthorizationUrl(
    if (as && !as.code_challenge_methods_supported?.includes("S256")) {
      // We assume S256 PKCE support, if the server does not advertise that,
      // a random `nonce` must be used for CSRF protection.
-      provider.checks = ["nonce"]
+      if (provider.type === "oidc") provider.checks = ["nonce"] as any
    } else {
      const { value, cookie } = await checks.pkce.create(options)
      authParams.set("code_challenge", value)
--- a/packages/core/src/lib/oauth/callback.ts
+++ b/packages/core/src/lib/oauth/callback.ts
@@ -24,7 +24,8 @@ import type { Cookie } from "../cookie.js"
 export async function handleOAuth(
  query: RequestInternal["query"],
  cookies: RequestInternal["cookies"],
-  options: InternalOptions<"oauth">
+  options: InternalOptions<"oauth" | "oidc">,
+  randomState?: string
 ) {
  const { logger, provider } = options
  let as: o.AuthorizationServer
@@ -71,9 +72,14 @@ export async function handleOAuth(

  const resCookies: Cookie[] = []

-  const state = await checks.state.use(cookies, resCookies, options)
+  const state = await checks.state.use(
+    cookies,
+    resCookies,
+    options,
+    randomState
+  )

-  const parameters = o.validateAuthResponse(
+  const codeGrantParams = o.validateAuthResponse(
    as,
    client,
    new URLSearchParams(query),
@@ -81,36 +87,26 @@ export async function handleOAuth(
  )

  /** https://www.rfc-editor.org/rfc/rfc6749#section-4.1.2.1 */
-  if (o.isOAuth2Error(parameters)) {
+  if (o.isOAuth2Error(codeGrantParams)) {
    logger.debug("OAuthCallbackError", {
      providerId: provider.id,
-      ...parameters,
+      ...codeGrantParams,
    })
-    throw new OAuthCallbackError(parameters.error)
+    throw new OAuthCallbackError(codeGrantParams.error)
  }

-  const codeVerifier = await checks.pkce.use(
-    cookies?.[options.cookies.pkceCodeVerifier.name],
-    options
-  )
+  const codeVerifier = await checks.pkce.use(cookies, resCookies, options)

-  if (codeVerifier) resCookies.push(codeVerifier.cookie)
-
-  // TODO:
-  const nonce = await checks.nonce.use(
-    cookies?.[options.cookies.nonce.name],
-    options
-  )
-  if (nonce && provider.type === "oidc") {
-    resCookies.push(nonce.cookie)
+  let redirect_uri = provider.callbackUrl
+  if (!options.isOnRedirectProxy && provider.redirectProxyUrl) {
+    redirect_uri = provider.redirectProxyUrl
  }
-
  let codeGrantResponse = await o.authorizationCodeGrantRequest(
    as,
    client,
-    parameters,
-    provider.callbackUrl,
-    codeVerifier?.codeVerifier ?? "auth" // TODO: review fallback code verifier
+    codeGrantParams,
+    redirect_uri,
+    codeVerifier ?? "auth" // TODO: review fallback code verifier
  )

  if (provider.token?.conform) {
@@ -131,11 +127,12 @@ export async function handleOAuth(
  let tokens: TokenSet

  if (provider.type === "oidc") {
+    const nonce = await checks.nonce.use(cookies, resCookies, options)
    const result = await o.processAuthorizationCodeOpenIDResponse(
      as,
      client,
      codeGrantResponse,
-      nonce?.value ?? o.expectNoNonce
+      nonce ?? o.expectNoNonce
    )

    if (o.isOAuth2Error(result)) {
--- a/packages/core/src/lib/oauth/checks.ts
+++ b/packages/core/src/lib/oauth/checks.ts
@@ -1,21 +1,26 @@
+import * as jose from "jose"
 import * as o from "oauth4webapi"
-import * as jwt from "../../jwt.js"
+import { InvalidCheck } from "../../errors.js"
+import { decode, encode } from "../../jwt.js"

 import type {
+  CookiesOptions,
  InternalOptions,
  RequestInternal,
-  CookiesOptions,
 } from "../../types.js"
 import type { Cookie } from "../cookie.js"

-import { InvalidState } from "../../errors.js"
+interface CheckPayload {
+  value: string
+}

 /** Returns a signed cookie. */
 export async function signCookie(
  type: keyof CookiesOptions,
  value: string,
  maxAge: number,
-  options: InternalOptions<"oauth">
+  options: InternalOptions<"oauth" | "oidc">,
+  data?: any
 ): Promise<Cookie> {
  const { cookies, logger } = options

@@ -23,9 +28,11 @@ export async function signCookie(

  const expires = new Date()
  expires.setTime(expires.getTime() + maxAge * 1000)
+  const token: any = { value }
+  if (type === "state" && data) token.data = data
  return {
    name: cookies[type].name,
-    value: await jwt.encode({ ...options.jwt, maxAge, token: { value } }),
+    value: await encode({ ...options.jwt, maxAge, token }),
    options: { ...cookies[type].options, expires },
  }
 }
@@ -44,68 +51,125 @@ export const pkce = {
    )
    return { cookie, value }
  },
-
  /**
-   * Returns code_verifier if provider uses PKCE,
-   * and clears the container cookie afterwards.
-   */
-  async use(
-    codeVerifier: string | undefined,
-    options: InternalOptions<"oauth">
-  ): Promise<{ codeVerifier: string; cookie: Cookie } | undefined> {
-    const { cookies, provider } = options
-
-    if (!provider?.checks?.includes("pkce") || !codeVerifier) {
-      return
-    }
-
-    const pkce = (await jwt.decode({
-      ...options.jwt,
-      token: codeVerifier,
-    })) as any
-
-    return {
-      codeVerifier: pkce?.value ?? undefined,
-      cookie: {
-        name: cookies.pkceCodeVerifier.name,
-        value: "",
-        options: { ...cookies.pkceCodeVerifier.options, maxAge: 0 },
-      },
-    }
-  },
-}
-
-const STATE_MAX_AGE = 60 * 15 // 15 minutes in seconds
-export const state = {
-  async create(options: InternalOptions<"oauth">) {
-    if (!options.provider.checks.includes("state")) return
-    // TODO: support customizing the state
-    const value = o.generateRandomState()
-    const maxAge = STATE_MAX_AGE
-    const cookie = await signCookie("state", value, maxAge, options)
-    return { cookie, value }
-  },
-  /**
-   * Returns state from the saved cookie
-   * if the provider supports states,
+   * Returns code_verifier if the provider is configured to use PKCE,
   * and clears the container cookie afterwards.
+   * An error is thrown if the code_verifier is missing or invalid.
+   * @see https://www.rfc-editor.org/rfc/rfc7636
+   * @see https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not/#pkce
   */
  async use(
    cookies: RequestInternal["cookies"],
    resCookies: Cookie[],
    options: InternalOptions<"oauth">
  ): Promise<string | undefined> {
-    const { provider, jwt } = options
+    const { provider } = options
+
+    if (!provider?.checks?.includes("pkce")) return
+
+    const codeVerifier = cookies?.[options.cookies.pkceCodeVerifier.name]
+
+    if (!codeVerifier)
+      throw new InvalidCheck("PKCE code_verifier cookie was missing.")
+
+    const value = await decode<CheckPayload>({
+      ...options.jwt,
+      token: codeVerifier,
+    })
+
+    if (!value?.value)
+      throw new InvalidCheck("PKCE code_verifier value could not be parsed.")
+
+    // Clear the pkce code verifier cookie after use
+    resCookies.push({
+      name: options.cookies.pkceCodeVerifier.name,
+      value: "",
+      options: { ...options.cookies.pkceCodeVerifier.options, maxAge: 0 },
+    })
+
+    return value.value
+  },
+}
+
+const STATE_MAX_AGE = 60 * 15 // 15 minutes in seconds
+export function decodeState(value: string):
+  | {
+      /** If defined, a redirect proxy is being used to support multiple OAuth apps with a single callback URL */
+      origin?: string
+      /** Random value for CSRF protection */
+      random: string
+    }
+  | undefined {
+  try {
+    const decoder = new TextDecoder()
+    return JSON.parse(decoder.decode(jose.base64url.decode(value)))
+  } catch {}
+}
+
+export const state = {
+  async create(options: InternalOptions<"oauth">, data?: object) {
+    const { provider } = options
+    if (!provider.checks.includes("state")) {
+      if (data) {
+        throw new InvalidCheck(
+          "State data was provided but the provider is not configured to use state."
+        )
+      }
+      return
+    }
+
+    const encodedState = jose.base64url.encode(
+      JSON.stringify({ ...data, random: o.generateRandomState() })
+    )
+
+    const maxAge = STATE_MAX_AGE
+    const cookie = await signCookie(
+      "state",
+      encodedState,
+      maxAge,
+      options,
+      data
+    )
+    return { cookie, value: encodedState }
+  },
+  /**
+   * Returns state if the provider is configured to use state,
+   * and clears the container cookie afterwards.
+   * An error is thrown if the state is missing or invalid.
+   * @see https://www.rfc-editor.org/rfc/rfc6749#section-10.12
+   * @see https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1
+   */
+  async use(
+    cookies: RequestInternal["cookies"],
+    resCookies: Cookie[],
+    options: InternalOptions<"oauth">,
+    paramRandom?: string
+  ): Promise<string | undefined> {
+    const { provider } = options
    if (!provider.checks.includes("state")) return

    const state = cookies?.[options.cookies.state.name]

-    if (!state) throw new InvalidState("State was missing from the cookies.")
+    if (!state) throw new InvalidCheck("State cookie was missing.")

    // IDEA: Let the user do something with the returned state
-    const value = (await jwt.decode({ ...options.jwt, token: state })) as any
+    const encodedState = await decode<CheckPayload>({
+      ...options.jwt,
+      token: state,
+    })

-    if (!value?.value) throw new InvalidState("Could not parse state cookie.")
+    if (!encodedState?.value)
+      throw new InvalidCheck("State (cookie) value could not be parsed.")
+
+    const decodedState = decodeState(encodedState.value)
+
+    if (!decodedState)
+      throw new InvalidCheck("State (encoded) value could not be parsed.")
+
+    if (decodedState.random !== paramRandom)
+      throw new InvalidCheck(
+        `Random state values did not match. Expected: ${decodedState.random}. Got: ${paramRandom}`
+      )

    // Clear the state cookie after use
    resCookies.push({
@@ -114,13 +178,13 @@ export const state = {
      options: { ...options.cookies.state.options, maxAge: 0 },
    })

-    return value.value
+    return encodedState.value
  },
 }

 const NONCE_MAX_AGE = 60 * 15 // 15 minutes in seconds
 export const nonce = {
-  async create(options: InternalOptions<"oauth">) {
+  async create(options: InternalOptions<"oidc">) {
    if (!options.provider.checks.includes("nonce")) return
    const value = o.generateRandomNonce()
    const maxAge = NONCE_MAX_AGE
@@ -128,28 +192,36 @@ export const nonce = {
    return { cookie, value }
  },
  /**
-   * Returns nonce from if the provider supports nonce,
+   * Returns nonce if the provider is configured to use nonce,
   * and clears the container cookie afterwards.
+   * An error is thrown if the nonce is missing or invalid.
+   * @see https://openid.net/specs/openid-connect-core-1_0.html#NonceNotes
+   * @see https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not/#nonce
   */
  async use(
-    nonce: string | undefined,
-    options: InternalOptions<"oauth">
-  ): Promise<{ value: string; cookie: Cookie } | undefined> {
-    const { cookies, provider } = options
+    cookies: RequestInternal["cookies"],
+    resCookies: Cookie[],
+    options: InternalOptions<"oidc">
+  ): Promise<string | undefined> {
+    const { provider } = options

-    if (!provider?.checks?.includes("nonce") || !nonce) {
-      return
-    }
+    if (!provider?.checks?.includes("nonce")) return

-    const value = (await jwt.decode({ ...options.jwt, token: nonce })) as any
+    const nonce = cookies?.[options.cookies.nonce.name]
+    if (!nonce) throw new InvalidCheck("Nonce cookie was missing.")

-    return {
-      value: value?.value ?? undefined,
-      cookie: {
-        name: cookies.nonce.name,
-        value: "",
-        options: { ...cookies.nonce.options, maxAge: 0 },
-      },
-    }
+    const value = await decode<CheckPayload>({ ...options.jwt, token: nonce })
+
+    if (!value?.value)
+      throw new InvalidCheck("Nonce value could not be parsed.")
+
+    // Clear the nonce cookie after use
+    resCookies.push({
+      name: options.cookies.nonce.name,
+      value: "",
+      options: { ...options.cookies.nonce.options, maxAge: 0 },
+    })
+
+    return value.value
  },
 }
--- a/packages/core/src/lib/oauth/handle-state.ts
+++ b/packages/core/src/lib/oauth/handle-state.ts
@@ -0,0 +1,34 @@
+import { InvalidCheck } from "../../errors.js"
+import { decodeState } from "./checks.js"
+
+import type { OAuthConfigInternal } from "../../providers/oauth.js"
+import type { InternalOptions, RequestInternal } from "../../types.js"
+
+/**
+ * When the authorization flow contains a state, we check if it's a redirect proxy
+ * and if so, we return the random state and the original redirect URL.
+ */
+export function handleState(
+  query: RequestInternal["query"],
+  provider: OAuthConfigInternal<any>,
+  isOnRedirectProxy: InternalOptions["isOnRedirectProxy"]
+) {
+  let randomState: string | undefined
+  let proxyRedirect: string | undefined
+
+  if (provider.redirectProxyUrl && !query?.state) {
+    throw new InvalidCheck(
+      "Missing state in query, but required for redirect proxy"
+    )
+  }
+
+  const state = decodeState(query?.state)
+  randomState = state?.random
+
+  if (isOnRedirectProxy) {
+    if (!state?.origin) return { randomState }
+    proxyRedirect = `${state.origin}?${new URLSearchParams(query)}`
+  }
+
+  return { randomState, proxyRedirect }
+}
--- a/packages/core/src/lib/providers.ts
+++ b/packages/core/src/lib/providers.ts
@@ -1,6 +1,5 @@
 import { merge } from "./utils/merge.js"

-import type { InternalProvider } from "../types.js"
 import type {
  OAuthConfig,
  OAuthConfigInternal,
@@ -8,6 +7,7 @@ import type {
  OAuthUserConfig,
  Provider,
 } from "../providers/index.js"
+import type { AuthConfig, InternalProvider } from "../types.js"

 /**
 * Adds `signinUrl` and `callbackUrl` to each provider
@@ -17,13 +17,15 @@ export default function parseProviders(params: {
  providers: Provider[]
  url: URL
  providerId?: string
+  options: AuthConfig
 }): {
  providers: InternalProvider[]
  provider?: InternalProvider
 } {
-  const { url, providerId } = params
+  const { url, providerId, options } = params

-  const providers = params.providers.map((provider) => {
+  const providers = params.providers.map((p) => {
+    const provider = typeof p === "function" ? p() : p
    const { options: userOptions, ...defaults } = provider

    const id = (userOptions?.id ?? defaults.id) as string
@@ -33,6 +35,7 @@ export default function parseProviders(params: {
    })

    if (provider.type === "oauth" || provider.type === "oidc") {
+      merged.redirectProxyUrl ??= options.redirectProxyUrl
      return normalizeOAuth(merged)
    }

@@ -61,11 +64,17 @@ function normalizeOAuth(

  const userinfo = normalizeEndpoint(c.userinfo, c.issuer)

+  const checks = c.checks ?? ["pkce"]
+  if (c.redirectProxyUrl) {
+    if (!checks.includes("state")) checks.push("state")
+    c.redirectProxyUrl = `${c.redirectProxyUrl}/callback/${c.id}`
+  }
+
  return {
    ...c,
    authorization,
    token,
-    checks: c.checks ?? ["pkce"],
+    checks,
    userinfo,
    profile: c.profile ?? defaultProfile,
  }
--- a/packages/core/src/lib/routes/callback.ts
+++ b/packages/core/src/lib/routes/callback.ts
@@ -1,15 +1,16 @@
-import { handleLogin } from "../callback-handler.js"
 import { CallbackRouteError, Verification } from "../../errors.js"
+import { handleLogin } from "../callback-handler.js"
 import { handleOAuth } from "../oauth/callback.js"
+import { handleState } from "../oauth/handle-state.js"
 import { createHash } from "../web.js"
 import { handleAuthorized } from "./shared.js"

 import type { AdapterSession } from "../../adapters.js"
 import type {
+  Account,
+  InternalOptions,
  RequestInternal,
  ResponseInternal,
-  InternalOptions,
-  Account,
 } from "../../types.js"
 import type { Cookie, SessionStore } from "../cookie.js"

@@ -43,10 +44,22 @@ export async function callback(params: {

  try {
    if (provider.type === "oauth" || provider.type === "oidc") {
+      const { proxyRedirect, randomState } = handleState(
+        query,
+        provider,
+        options.isOnRedirectProxy
+      )
+
+      if (proxyRedirect) {
+        logger.debug("proxy redirect", { proxyRedirect, randomState })
+        return { redirect: proxyRedirect }
+      }
+
      const authorizationResult = await handleOAuth(
        query,
        params.cookies,
-        options
+        options,
+        randomState
      )

      if (authorizationResult.cookies.length) {
@@ -139,7 +152,6 @@ export async function callback(params: {
        })
      }

-      // @ts-expect-error
      await events.signIn?.({ user, account, profile, isNewUser })

      // Handle first logins on new accounts
--- a/packages/core/src/lib/routes/session.ts
+++ b/packages/core/src/lib/routes/session.ts
@@ -9,7 +9,7 @@ import type { SessionStore } from "../cookie.js"
 export async function session(
  sessionStore: SessionStore,
  options: InternalOptions
-): Promise<ResponseInternal<Session | {}>> {
+): Promise<ResponseInternal<Session | null>> {
  const {
    adapter,
    jwt,
@@ -19,8 +19,8 @@ export async function session(
    session: { strategy: sessionStrategy, maxAge: sessionMaxAge },
  } = options

-  const response: ResponseInternal<Session | {}> = {
-    body: {},
+  const response: ResponseInternal<Session | null> = {
+    body: null,
    headers: { "Content-Type": "application/json" },
    cookies: [],
  }
--- a/packages/core/src/lib/routes/signin.ts
+++ b/packages/core/src/lib/routes/signin.ts
@@ -18,7 +18,7 @@ import type {
 export async function signin(
  query: RequestInternal["query"],
  body: RequestInternal["body"],
-  options: InternalOptions<"oauth" | "email">
+  options: InternalOptions<"oauth" | "oidc" | "email">
 ): Promise<ResponseInternal> {
  const { url, logger, provider } = options
  try {
--- a/packages/core/src/lib/web.ts
+++ b/packages/core/src/lib/web.ts
@@ -37,7 +37,7 @@ export async function toInternalRequest(

    const action = actions.find((a) => pathname.includes(a))
    if (!action) {
-      throw new UnknownAction("Cannot detect action.")
+      throw new UnknownAction(`Cannot detect action in pathname (${pathname}).`)
    }

    if (req.method !== "GET" && req.method !== "POST") {
@@ -78,7 +78,6 @@ export function toResponse(res: ResponseInternal): Response {
    const cookieHeader = serialize(name, value, options)
    if (headers.has("Set-Cookie")) headers.append("Set-Cookie", cookieHeader)
    else headers.set("Set-Cookie", cookieHeader)
-    // headers.set("Set-Cookie", cookieHeader) // TODO: Remove. Seems to be a bug with Headers in the runtime
  })

  let body = res.body
--- a/packages/core/src/providers/index.ts
+++ b/packages/core/src/providers/index.ts
@@ -44,6 +44,12 @@ export interface CommonProviderOptions {
  type: ProviderType
 }

+interface InternalProviderOptions {
+  /** Used to deep merge user-provided config with the default config
+   */
+  options?: Record<string, unknown>
+}
+
 /**
 * Must be a supported authentication provider config:
 * - {@link OAuthConfig}
@@ -57,17 +63,14 @@ export interface CommonProviderOptions {
 * @see [Credentials guide](https://authjs.dev/guides/providers/credentials)
 */
 export type Provider<P extends Profile = Profile> = (
-  | OIDCConfig<P>
-  | OAuth2Config<P>
-  | EmailConfig
-  | CredentialsConfig
-) & {
-  /**
-   * Used to deep merge user-provided config with the default config
-   * @internal
-   */
-  options: Record<string, unknown>
-}
+  | ((OIDCConfig<P> | OAuth2Config<P> | EmailConfig | CredentialsConfig) &
+      InternalProviderOptions)
+  | ((
+      ...args: any
+    ) => (OAuth2Config<P> | OIDCConfig<P> | EmailConfig | CredentialsConfig) &
+      InternalProviderOptions)
+) &
+  InternalProviderOptions

 export type BuiltInProviders = Record<
  OAuthProviderType,
--- a/packages/core/src/providers/oauth.ts
+++ b/packages/core/src/providers/oauth.ts
@@ -1,8 +1,14 @@
 import type { Client } from "oauth4webapi"
-import type { Awaitable, Profile, TokenSet, User } from "../types.js"
 import type { CommonProviderOptions } from "../providers/index.js"
+import type {
+  AuthConfig,
+  Awaitable,
+  Profile,
+  TokenSet,
+  User,
+} from "../types.js"

-// TODO:
+// TODO: fix types
 type AuthorizationParameters = any
 type CallbackParamsType = any
 type IssuerMetadata = any
@@ -19,7 +25,7 @@ type UrlParams = Record<string, unknown>

 type EndpointRequest<C, R, P> = (
  context: C & {
-    /** Provider is passed for convenience, ans also contains the `callbackUrl`. */
+    /** Provider is passed for convenience, and also contains the `callbackUrl`. */
    provider: OAuthConfigInternal<P> & {
      signinUrl: string
      callbackUrl: string
@@ -95,7 +101,7 @@ export interface OAuthProviderButtonStyles {
  textDark: string
 }

-/** TODO: */
+/** TODO: Document */
 export interface OAuth2Config<Profile>
  extends CommonProviderOptions,
    PartialIssuer {
@@ -143,11 +149,14 @@ export interface OAuth2Config<Profile>
   * The CSRF protection performed on the callback endpoint.
   * @default ["pkce"]
   *
+   * @note When `redirectProxyUrl` or {@link AuthConfig.redirectProxyUrl} is set,
+   * `"state"` will be added to checks automatically.
+   *
   * [RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients (PKCE)](https://www.rfc-editor.org/rfc/rfc7636.html#section-4) |
   * [RFC 6749 - The OAuth 2.0 Authorization Framework](https://www.rfc-editor.org/rfc/rfc6749.html#section-4.1.1) |
   * [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html#IDToken) |
   */
-  checks?: Array<"pkce" | "state" | "none" | "nonce">
+  checks?: Array<"pkce" | "state" | "none">
  clientId?: string
  clientSecret?: string
  /**
@@ -157,9 +166,20 @@ export interface OAuth2Config<Profile>
  client?: Partial<Client>
  style?: OAuthProviderButtonStyles
  /**
-   * [Documentation](https://authjs.dev/reference/providers/oauth#allowdangerousemailaccountlinking-option)
+   * Normally, when you sign in with an OAuth provider and another account
+   * with the same email address already exists,
+   * the accounts are not linked automatically.
+   *
+   * Automatic account linking on sign in is not secure
+   * between arbitrary providers and is disabled by default.
+   * Learn more in our [Security FAQ](https://authjs.dev/reference/faq#security).
+   *
+   * However, it may be desirable to allow automatic account linking if you trust that the provider involved has securely verified the email address
+   * associated with the account. Set `allowDangerousEmailAccountLinking: true`
+   * to enable automatic account linking.
   */
  allowDangerousEmailAccountLinking?: boolean
+  redirectProxyUrl?: AuthConfig["redirectProxyUrl"]
  /**
   * The options provided by the user.
   * We will perform a deep-merge of these values
@@ -170,10 +190,11 @@ export interface OAuth2Config<Profile>
  options?: OAuthUserConfig<Profile>
 }

-/** TODO: */
+/** TODO: Document */
 export interface OIDCConfig<Profile>
-  extends Omit<OAuth2Config<Profile>, "type"> {
+  extends Omit<OAuth2Config<Profile>, "type" | "checks"> {
  type: "oidc"
+  checks?: OAuth2Config<Profile>["checks"] & Array<"nonce">
 }

 export type OAuthConfig<Profile> = OIDCConfig<Profile> | OAuth2Config<Profile>
@@ -183,21 +204,37 @@ export type OAuthEndpointType = "authorization" | "token" | "userinfo"
 /**
 * We parsed `authorization`, `token` and `userinfo`
 * to always contain a valid `URL`, with the params
- * @internal
 */
 export type OAuthConfigInternal<Profile> = Omit<
  OAuthConfig<Profile>,
-  OAuthEndpointType
+  OAuthEndpointType | "redirectProxyUrl"
 > & {
  authorization?: { url: URL }
  token?: {
    url: URL
    request?: TokenEndpointHandler["request"]
+    /** @internal */
    conform?: TokenEndpointHandler["conform"]
  }
  userinfo?: { url: URL; request?: UserinfoEndpointHandler["request"] }
+  /**
+   * Reconstructed from {@link OAuth2Config.redirectProxyUrl},
+   * adding the callback action and provider id onto the URL.
+   *
+   * If defined, it is favoured over {@link OAuthConfigInternal.callbackUrl} in the authorization request.
+   *
+   * When {@link InternalOptions.isOnRedirectProxy} is set, the actual value is saved in the decoded `state.origin` parameter.
+   *
+   * @example `"https://auth.example.com/api/auth/callback/:provider"`
+   *
+   */
+  redirectProxyUrl?: OAuth2Config<Profile>["redirectProxyUrl"]
 } & Pick<Required<OAuthConfig<Profile>>, "clientId" | "checks" | "profile">

+export type OIDCConfigInternal<Profile> = OAuthConfigInternal<Profile> & {
+  checks: OIDCConfig<Profile>["checks"]
+}
+
 export type OAuthUserConfig<Profile> = Omit<
  Partial<OAuthConfig<Profile>>,
  "options" | "type"
--- a/packages/core/src/providers/onelogin.js
+++ b/packages/core/src/providers/onelogin.js
@@ -4,7 +4,6 @@ export default function OneLogin(options) {
    id: "onelogin",
    name: "OneLogin",
    type: "oidc",
-    // TODO: Verify if issuer has "oidc/2" and remove if it does
    wellKnown: `${options.issuer}/oidc/2/.well-known/openid-configuration`,
    options,
  }
--- a/packages/core/src/providers/reddit.js
+++ b/packages/core/src/providers/reddit.js
@@ -7,6 +7,7 @@ export default function Reddit(options) {
    authorization: "https://www.reddit.com/api/v1/authorize?scope=identity",
    token: "https://www.reddit.com/api/v1/access_token",
    userinfo: "https://oauth.reddit.com/api/v1/me",
+    checks: ["state"],
    style: {
      logo: "/reddit.svg",
      bg: "#fff",
--- a/packages/core/src/providers/trakt.ts
+++ b/packages/core/src/providers/trakt.ts
@@ -22,7 +22,6 @@ export default function Trakt<P extends TraktUser>(
    id: "trakt",
    name: "Trakt",
    type: "oauth",
-    // when default, trakt returns auth error. TODO: Does it?
    authorization: "https://trakt.tv/oauth/authorize?scope=",
    token: "https://api.trakt.tv/oauth/token",
    userinfo: {
--- a/packages/core/src/providers/wikimedia.ts
+++ b/packages/core/src/providers/wikimedia.ts
@@ -169,7 +169,6 @@ export default function Wikimedia<P extends WikimediaProfile>(
    type: "oauth",
    token: "https://meta.wikimedia.org/w/rest.php/oauth2/access_token",
    userinfo: "https://meta.wikimedia.org/w/rest.php/oauth2/resource/profile",
-    // TODO: is empty scope necessary?
    authorization:
      "https://meta.wikimedia.org/w/rest.php/oauth2/authorize?scope=",
    profile(profile) {
--- a/packages/core/src/providers/yandex.ts
+++ b/packages/core/src/providers/yandex.ts
@@ -43,20 +43,21 @@ export interface YandexProfile {
  is_avatar_empty?: boolean
  /**
   * ID of the Yandex user's profile picture.
-   * The profile picture with this ID can be downloaded via a link that looks like this:
+   * Format for downloading user avatars: `https://avatars.yandex.net/get-yapic/<default_avatar_id>/<size>`
   * @example "https://avatars.yandex.net/get-yapic/31804/BYkogAC6AoB17bN1HKRFAyKiM4-1/islands-200"
+   * Available sizes: 
+   * `islands-small`: 28×28 pixels.
+   * `islands-34`: 34×34 pixels.
+   * `islands-middle`: 42×42 pixels.
+   * `islands-50`: 50×50 pixels.
+   * `islands-retina-small`: 56×56 pixels.
+   * `islands-68`: 68×68 pixels.
+   * `islands-75`: 75×75 pixels.
+   * `islands-retina-middle`: 84×84 pixels.
+   * `islands-retina-50`: 100×100 pixels.
+   * `islands-200`: 200×200 pixels.
   */
-  default_avatar_id?:
-    | "islands-small"
-    | "islands-34"
-    | "islands-middle"
-    | "islands-50"
-    | "islands-retina-small"
-    | "islands-68"
-    | "islands-75"
-    | "islands-retina-middle"
-    | "islands-retina-50"
-    | "islands-200"
+  default_avatar_id?: string
  /**
   * The user's date of birth in YYYY-MM-DD format.
   * Unknown elements of the date are filled in with zeros, such as: `0000-12-23`.
@@ -71,8 +72,8 @@ export interface YandexProfile {
   * Non-Latin characters of the first and last names are presented in Unicode format.
   */
  real_name?: string
-  /** User's gender. Possible values: Male: `male', Female: `female`, Unknown gender: `null` */
-  sex?: string
+  /** User's gender. `null` Stands for unknown or unspecified gender. Will be `undefined` if not provided by Yandex. */
+  sex?: "male" | "female" | null
  /**
   * The default phone number for contacting the user.
   * The API can exclude the user's phone number from the response at its discretion.
--- a/packages/core/src/types.ts
+++ b/packages/core/src/types.ts
@@ -61,21 +61,22 @@ import type {
  OpenIDTokenEndpointResponse,
 } from "oauth4webapi"
 import type { Adapter, AdapterUser } from "./adapters.js"
+import { AuthConfig } from "./index.js"
+import type { JWT, JWTOptions } from "./jwt.js"
+import type { Cookie } from "./lib/cookie.js"
+import type { LoggerInstance } from "./lib/utils/logger.js"
 import type {
  CredentialInput,
  CredentialsConfig,
  EmailConfig,
  OAuthConfigInternal,
+  OIDCConfigInternal,
  ProviderType,
 } from "./providers/index.js"
-import type { JWT, JWTOptions } from "./jwt.js"
-import type { Cookie } from "./lib/cookie.js"
-import type { LoggerInstance } from "./lib/utils/logger.js"
-import { AuthConfig } from "./index.js"

 export type { AuthConfig } from "./index.js"
-export type Awaitable<T> = T | PromiseLike<T>
 export type { LoggerInstance }
+export type Awaitable<T> = T | PromiseLike<T>

 /**
 * Change the theme of the built-in pages.
@@ -121,10 +122,10 @@ export interface Account extends Partial<OpenIDTokenEndpointResponse> {

 /** The OAuth profile returned from your provider */
 export interface Profile {
-  sub?: string
-  name?: string
-  email?: string
-  image?: string
+  sub?: string | null
+  name?: string | null
+  email?: string | null
+  image?: string | null
 }

 /** [Documentation](https://authjs.dev/guides/basics/callbacks) */
@@ -372,12 +373,15 @@ export interface User {
 /** @internal */
 export type InternalProvider<T = ProviderType> = (T extends "oauth"
  ? OAuthConfigInternal<any>
+  : T extends "oidc"
+  ? OIDCConfigInternal<any>
  : T extends "email"
  ? EmailConfig
  : T extends "credentials"
  ? CredentialsConfig
  : never) & {
  signinUrl: string
+  /** @example `"https://example.com/api/auth/callback/id"` */
  callbackUrl: string
 }

@@ -406,7 +410,7 @@ export interface RequestInternal {

 /** @internal */
 export interface ResponseInternal<
-  Body extends string | Record<string, any> | any[] = any
+  Body extends string | Record<string, any> | any[] | null = any
 > {
  status?: number
  headers?: Headers | HeadersInit
@@ -415,7 +419,6 @@ export interface ResponseInternal<
  cookies?: Cookie[]
 }

-// TODO: rename to AuthConfigInternal
 /** @internal */
 export interface InternalOptions<TProviderType = ProviderType> {
  providers: InternalProvider[]
@@ -436,4 +439,9 @@ export interface InternalOptions<TProviderType = ProviderType> {
  callbacks: CallbacksOptions
  cookies: CookiesOptions
  callbackUrl: string
+  /**
+   * If true, the OAuth callback is being proxied by the server to the original URL.
+   * See also {@link OAuthConfigInternal.redirectProxyUrl}.
+   */
+  isOnRedirectProxy: boolean
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
GitHub Actions	0ddd47cc0a	chore(release): bump package version(s) [skip ci]	2023-04-20 09:38:01 +00:00
Balázs Orbán	0100888d9b	fix: consume nonce exactly once (#7327 ) * fix: consume nonce exactly once * tweak state handling	2023-04-20 10:25:41 +01:00
Balázs Orbán	9eeea02fe2	feat: redirect proxy (#7326 ) * types * add `redirectProxy` option * ignore if no state * empty commit * tweak proxy detection * add origin proxy check to checks * run randomstate decode * don't generate state data when no proxy * ignore next-2 * update dev app * clarify `UnknownAction` error * rename to `AUTH_REDIRECT_PROXY_URL` * simplify state * clear todos * cleanup * clarify comment * use `InalidChecks` error * simplify * clarify errors * add debug logger to redirect proxy * add proxy redirect logger * don't throw error when no origin on proxy * fix redirect_uri in callback * add docs/guide * sort imports * docs: rephrase	2023-04-20 09:53:44 +01:00
GitHub Actions	0a57fea430	chore(release): bump package version(s) [skip ci]	2023-04-20 08:41:41 +00:00
Tim Schneider	51750e1a06	fix(adapters): correct peer dependency (#7310 ) Typo in package.json Missing \| in package.json causing ETARGET and peer dependency errors	2023-04-20 09:23:30 +01:00
Balázs Orbán	039a14d992	fix: clarify unknown action error	2023-04-19 10:40:51 +02:00
Balázs Orbán	da821d2789	chore: cleanup todos, format	2023-04-19 10:40:42 +02:00
Balázs Orbán	be5c42e350	Merge branch 'main' of github.com:nextauthjs/next-auth	2023-04-19 10:36:50 +02:00
Balázs Orbán	b68f461f8b	chore: upgrade `next`	2023-04-19 10:35:34 +02:00
Nick Parsons	95c5ba0b5d	docs: Update Clerk sponsorship URL (#7305 ) - Change Clerk URL from `https://clerk.dev` to `https://clerk.com` - Fix alt from copy/paste	2023-04-18 20:13:19 +01:00
GitHub Actions	25388de027	chore(release): bump package version(s) [skip ci]	2023-04-18 17:45:29 +00:00
Balázs Orbán	ad77e1c2b7	chore: trigger CI	2023-04-18 19:31:51 +02:00
Balázs Orbán	cd654c3001	chore: trigger CI	2023-04-18 19:09:53 +02:00
Balázs Orbán	6f9ca4143d	fix: detect origin when `instanceof Request` check fails (#7303 )	2023-04-18 17:46:49 +01:00
Balázs Orbán	e97b27414a	Merge branch 'main' of github.com:nextauthjs/next-auth	2023-04-17 11:41:02 +02:00
Balázs Orbán	9018939ee7	docs: clean up databases intro page #7221	2023-04-17 11:40:59 +02:00
Raul	c2fc41b44d	chore: fix "Contributing guide" link (#7279 )	2023-04-17 10:36:23 +01:00
Chris Hayes	01d7eb4feb	docs: Remove --save from install command (#7277 ) Remove --save from install command --save is no longer needed on npm install.	2023-04-17 10:35:48 +01:00
Balázs Orbán	2388c20cc6	Merge branch 'main' of github.com:nextauthjs/next-auth	2023-04-17 11:32:26 +02:00
Balázs Orbán	9a1bef9e72	chore: skip adapters in docs dev by default	2023-04-17 11:32:23 +02:00
Balázs Orbán	35a72d2273	chore: update `typedoc` dependencies	2023-04-17 11:32:09 +02:00
Abdulaziz Askaraliev	5f1b75a7a2	fix(providers): fix type definition and docs for yandex (#7170 ) Co-authored-by: Thang Vu <hi@thvu.dev>	2023-04-16 14:47:06 +07:00
Thang Vu	fa58065951	chore: move `next-auth` from `v4` to `main` (#7265 )	2023-04-15 17:02:46 +01:00
Balázs Orbán	b31f2af66c	feat: misc improvements (#7228 ) * tweak types, fix typos * filter non-oauth files when generating provider types * allow implicit config invoke * remove workaround for multiple cookie settings in Next.js * feat: return `null` when session does not exist * error on missing checks when configured	2023-04-12 11:40:55 +01:00
Prana Adiwira	71bb6f2590	fix(providers): Use the proper check for Reddit (#7224 ) Reddit expects the `state` parameter https://github.com/reddit-archive/reddit/wiki/OAuth2#authorization	2023-04-12 11:37:31 +01:00
				`@@ -0,0 +1 @@`
				`//registry.npmjs.org/:_authToken=${NPM_TOKEN}`